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ADVANCED RISK ASSESSMENT OF THE EFFECTS OF GRAPHITE 
FIBERS ON ELECTRONIC AND ELECTRICAL EQUIPMENT 

EXECUTIVE SUMMARY 


ORI, Inc., in Phase I of its NASA Contract No. NAS1-15379, developed 
a model to generate quantitative estimates of the risk associated with the 
release of graphite fibers during fires involving commercial aircraft con- 
structed with graphite fiber composite materials. The model was used to 
estimate the risk associated with accidents at several U.S. airports. These 
results were then combined to provide an estimate of the total risk to the 
nation. 

Composite material formed of graphite fibers encased in epoxy resin 
provides a material strong and light enough to replace aluminum, steel, or 
titanium in many applications. Evidence exists that these fibers can cause 
failures of exposed electrical, electronic, and power equipment. Further, 
burning of the composite material can result in the release of fibers into 
the environment. Thus, fires involving the composite material can result in 
accidental release of graphite (carbon) fibers in amounts sufficient to 
damage electrical or electronic equipment, and pose a hazard to the popula- 
tion near the accident site. The probability of such accidental release and 
subsequent dissemination of critical amounts of carbon fiber is not known, 
and therefore the associated risk cannot be accurately quantified. However, 
the use of graphite fiber composite material is expected to increase rapidly, 
and the risk will undergo a corresponding increase. 
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The Federal Government has implemented a plan assigning specific 
aspects of this problem to particular agencies, in order to deal with the 
potential problem associated with use of the graphite fiber material. One 
of the responsibilities assigned to NASA is the investigation of the vulner- 
ability of commercial aircraft equipment. The NASA Langley Research Center 
is undertaking this investigation as part of a major program that examines 
accidental carbon fiber release, dissemination and redissemination of the 
fibers, transfer of the fibers into buildings and other enclosures, and 
vulnerability of household, industrial, and aircraft equipment. The ultimate 
goal of the NASA Langley Research Center program is an assessment of the 
magnitude of the risk. 

AIRPORT - URBAN AREA RISK ASSESSMENT 

In order to estimate the risk associated with accidental release of 
carbon fibers following a commercial aircraft accident with fire, ORI devel- 
oped a Monte Carlo simulation model that replicates many possible aircraft 
accidents with fires and estimates the costs associated with the subsequent 
release of the fibers, their downwind transport under different meteorological 
conditions, their transfer into offices, factories, and homes, and subsequent 
failures of vulnerable equipment. 

The Method 

The method employed by ORI involves the repeated calculation of 
possible accident effects, using a model to represent the principal events 
associated with each accident, and calculating statistics after the replica- 
tion of many accidents. The simulation model elements and their interrelation- 
ships are illustrated in Figure 1. The events being simulated are identified 
by the shaded boxes. Random accidents are generated for each simulated sample 
year, with repeated sampling to obtain the final statistical distributions. 

The principal steps followed for one sample year's events at one airport are: 

• Generate Accident— We first compute the number of accidents 
that will be simulated during the sample year at the airport 
for each aircraft category. This number is obtained by making 
a random draw from a Poisson distribution. The mean of the 
distribution is estimated by calculating the ratio of the number 
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of operations in the particular aircraft category to the projec- 
ted total number of air carrier operations in the United States, 
and then multiplying by the projected national annual rate of 
aircraft accidents with fires. The mean is further adjusted to 
account for the expected fraction of aircraft in each category 
that will. contain graphite fiber composite material. Each of 
the accidents will be simulated for each aircraft category pro- 
cessed in sequence. The model randomly assigns the operational 
phase and location of the accident, using probability distribu- 
tions based on statistical analysis of accident data in the 
National Transportation Safety Board files. At the end of the 
genera te-acci dent phase of the calculation, we have the aircraft 
category, operational phase, and location of the accident. 

The techniques applied here are considered entirely appro- 
priate. The extrapolation of accident rates into the future 
introduces some uncertainty, however, as does the assumption 
that the location and operational phase statistics generated 
from many accidents at different airports can be applied to one 
airport. There is essentially no alternative available. 

• Compute Weather Details . The weather conditions which are re- 
quired for subsequent calculations are the surface wind speed 
and direction, and the associated atmospheric stability con- 
dition. The joint distribution of these variables is available 
'for all airports considered in a data base maintained at ORI 
under a joint EPA-FAA contract. One combination of wind speed 
and direction, and stability category is randomly selected from 
this historical frequency distribution. The method used here, 
with the meteorological data base available, introduces no 
approximation. At this stage in the computation we are ready 
to do the two calculations described next. 

• Compute Plume Height . In this step the model computes the height 
to which the plume will grow when it is stabilized. This height 
is based on the aircraft class, the operational phase during 
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which the accident took place, and the weather conditions. The 
aircraft size determines the size of the fire, or rate of energy 
release, which, with the meteorological stability conditions, 
determines the behavior of the fire plume. Classical methods 
are used to compute the plume height, but the behavior of the 
fire plume at the inversion level is subject to some uncertainty. 
One inversion height is assigned to each stability category for 
each airport, and it is assumed that the plume never penetrates 
the inversion. This assumption is considered conservative, i.e., 
it overstates the risk. 

• Compute Downwind Exposure. The weather details and the fire 
plume height are used in the downwind exposure calculation, 
based on a standard Gaussian plume model, modified to include 
fallout of the graphite fibers and partial reflection at the 
earth's surface. The use of a more sophisticated diffusion 
model did not appear warranted because of uncertainties in other 
phases of the computation. The amount of graphite fiber involved 
in the fire is also determined. The fraction of composite 
material in the aircraft structure that is involved in the fire 
is assumed to be equal to the fraction of the aircraft that is 
involved in the fire, which is fixed for each operational phase- 
aircraft type combination. This assumption was introduced 
because of the unavailability of detailed accident analyses, and 
tends to reduce the likelihood of extreme values occurring in 
the results. 

Exterior exposure values are computed at points within a set 
of representative circles covering the region around the airport 
out to a range of at least fifty miles. The impact calculations 
described below are also done for each of these points. The 
use of the representative circles constitutes a satisfactory 
approximation, since the simulation is repeated for many 
accident locations and wind directions, and the results are 
expressed probabilistically. 
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• Compute Interior Exposure . It was assumed that each type of 
residential unit, business, or industry at each of the key points 
for which the exposure is computed can be characterized by a 
typical building or type of enclosure. These characteristics 
determine how the exposure inside the building is related to 

the exposure outside; the exposure inside is calculated for each 
class of business and industry present. The definition of typi- 
cal building types leads to results that are satisfactory in the 
expected-value sense, but limits the spread of the results. 

Increased variance in the input characteristics would, however, 
require additional simulation runs in order to yield stable results. 

• Compute Failures . Each individual vulnerable piece of equipment 
obeys an exponential failure law, which is in reasonable agreement 
with available experimental results. For each business-industry 
category, as defined by the Standard Industrial Classification 
(SIC) two-digit code, a standard equipment configuration is defined. 
The model computes the overall probability of failure for each 
typical plant or facility from the interior exposure values and 

the equipment failure parameters. Similarly, household equipment 
failures are computed for each household class at each of the 
characteristic points in the geographical area. This is essentially 
an expected value calculation. 

• Compute Costs . For each residential unit the impact is estimated 
on the basis of the fraction of the equipments expected to be 
damaged, and a standard repair cost. The business-industry impact 
is estimated by allocating to each local business category its share 
of the Gross Domestic Product, based on the ratio of its local pay- 
roll to the national payroll for the same SIC two-digit code. The 
impact is then obtained by multiplying each business category's 
overall failure probability by its allocated local daily share of 
the Gross Domestic Product. The calculation thus assumes that a 
complete closing of a business will result in a financial impact 
equal to the business's share of the Gross Domestic Product; this 
neglects the costs of effects other than a complete shutdown, but 
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does include some secondary effects associated with one indus- 
trial sector's effect on others. 

• Compute Statistics. The computation of the interior exposure, 
resulting failures, and their impact is done for all industries 
and residential units at all of the points representing a county 
or a portion of a county. After the computation is done for one 
county, the model moves on to the next one; all industries and 
residential units there are processed. Damage costs for all 
affected geographic areas are then totalled to yield the estimate 
of the total impact of one accident. Any additional accidents 
for the same aircraft category are then treated in the same way, 
after which accidents in the next aircraft category are simulated. 
This process is repeated for all aircraft categories— all acci- 
dents —for the sample year to obtain the total impact of graphite 
fiber accidents during that year. Another sample is then drawn 
generating the accidents to be simulated during the next repli- 
cation. 

+ 

The sequence of steps described above is repeated for many sample years pro- 
viding the annual dollar value of the impact for each sample, after which the 
frequency distribution of annual costs is generated. In addition, the model 
prepares a risk profile, showing the probability that a given annual cost is 
exceeded, and details describing the ten most costly accidents. 

Results 

Results were obtained using input values that were the best estimates 
available to the NASA-ORI team for the 1985 and 1993 time periods of interest. 
The model computes, after many replications, a risk profile which gives the 
probability that the annual cost associated with equipment failures following 
an accident exceeds a stated amount. 

The 1985 and 1993 risk profiles for Washington National Airport are 
shown in Figure 2. Results indicate an expected (average) annual impact of 
$110 for 1985 and $1,200 for 1993. For 1993, the probability that the damage 
in any one year would exceed $100,000 is .0025 (25 in ten thousand), while for 
$1,000,000 it is .0001 (1 in ten thousand). 


vii 



PROBABILITY OF EXCEEDING COST SHOWN 





There is some uncertainty with regard to many of the required input 
parameters. If it is assumed that these uncertainties correspond to a factor 
of ten in the product of the amount of fiber released in the aircraft fire, 
the effect of downwind transport and diffusion, and the transfer into build- 
ings, we can estimate that the risk could be as high as .01 (1 in a hundred) 
that the annual impact would exceed $100,000, and .002 (2 in a thousand) that 
it would exceed $1,000,000. 

The examination of individual accidents shows that the effects of the 
accidental release of graphite fibers can be felt at considerable distances 
downwind. For example, more than half of the greater- than-$4, 000, 000 impact 
of one simulated 1993 accident at Washington National Airport was due to the 
calculated effect on business and industry in downtown Baltimore. 

The individual airport risk is in part a function of the number of 
aircraft operations at an airport and the amount of business and industry at 
risk in the area surrounding the airport. For O'Hare Airport at Chicago, the 
nation's busiest, for example, the expected (average) annual risk is $300 for 
1985 and $2,700 for 1993. For 1993, the probability is estimated to be .0004 
(4 in ten thousand) that the annual impact will exceed $1,000,000 and .00001 
(1 in a hundred thousand) that it will exceed $10,000,000, Several 1993 air- 
port risk profiles are compared in Figure 3, 

NATIONAL RISK PROFILE 

The total national risk can be estimated in several ways. A national 
model can be exercised in the same way as the single airport model. The num- 
ber of accidents in the country would be generated and accidents assigned to 
individual airports. Another method is to develop the risk profiles for a 
number of airports and then combine them to yield a national risk profile. 

In order to develop individual airport results which are of considerable 
interest in their own right, as well as the national risk estimate, the latter 
method was used. 

The national results, illustrated by the 1985 and 1993 risk profiles 
in Figure 4, indicate that the expected annual national impact is approximately 
$3,000 for 1985 and $35,000 for 1993. For 1993, it is estimated that the 
probability of exceeding an annual national impact of $1,000,000 (in 1976 dollars) 
is approximately .005 (5 in one thousand) and decreases to .0001 (1 in ten 
thousand) for $10,000,000. 
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ANNUAL COST IN DOLLARS 


FIGURE 4. NATIONAL RISK PROFILES OBTAINED BY COMBINING 
NINE INDIVIDUAL AIRPORT RESULTS ADJUSTED TO ACCOUNT FOR ALL 
U.S. FLIGHT OPERATIONS — 1985 AND 1993 
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I. INTRODUCTION 


This is the final report of the work performed by ORI, Inc., in 
Phase I of the Graphite Fiber Risk Assessment Program sponsored by NASA, 
under Contract Number NASI -15379 . The ORI efforts were concentrated on the 
development of a computerized model to be used in preparing quantitative esti 
mates of the risk associated with the release of graphite fibers during fires 
involving portions of commercial aircraft constructed of graphite fiber 
composite materials. 

Composite material formed of a graphite fiber mesh encased in epoxy 
resin provides a material strong and light enough to replace aluminum, steel, 
or titanium in many applications. Graphite composite structures are under 
development for use in commercial transport aircraft. These developments 
include: 

• Rudder control tab for the McDonnell Douglas DC-9 Super 80 
configuration. 

• Inboard ailerons for possible application on the Lockheed 
L-1011 . 

t Secondary structures on the Boeing 767. 

NASA's aircraft energy efficiency (ACEE) program is supporting advanced com- 
mercial transport composite structures development. Union Carbide has 
announced plans to build a carbon fiber plant to begin operating in 1981 
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with an initial production capacity of 800,000 pounds of carbon fiber a 
year. They estimate the total market in 1979 to be one million pounds of 
carbon fiber. 

In view of evidence from a variety of sources that the fiber can 
damage electrical equipment, and that pieces in the critical size range can 
be released by fires involving the composite material , NASA, as part of 
a national program, is investigating the potential risk that these contem- 
plated uses of graphite/epoxy material constitute. The probability of 
accidental release and the dissemination of carbon fibers at critical damage 
levels is not known and the risk cannot be accurately quantified. However, 
the use of composite material is expected to increase at a rapid rate, and 
the risk which is related to the amount of CF in use will increase accord- 
ingly. 

The Federal Government has produced a plan involving many agencies 
to deal with all aspects of the potential problem associated with CF. One 
of the responsibilities assigned to NASA is the investigation of the vulner- 
ability of commercial aircraft equipment. NASA Langley is undertaking this 
investigation as part of a larger program that involves accidental fiber 
release, fiber dissemination and redissemination, transfer of fibers to 
enclosures, and equipment (household, industrial, aircraft, etc.) vulner- 
ability. The ultimate goal of the NASA Langley program is an assessment of 
the magnitude of the risk. 

In order to estimate the risk, 0RI has developed a stochastic model 
that replicates many possible aircraft accidents with fire, and estimates 
the dollar costs associated with the subsequent release of the fibers, their 
downwind transport under different mete rologi cal conditions, their transfer 
into offices, factories, and homes, and subsequent failures of vulnerable 
equipment. The model was used to estimate the risk associated with acci- 
dents at several major U.S. airports. These results were later combined to 
provide an initial estimate of the total risk to the nation. 
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The results were obtained using a variety of input parameters that 
were, in all cases, the best estimates available to the NASA-ORI team for 
the time periods of most interest to NASA: 1985 and 1993. The results 

indicate that the risk, expressed as the probability that the annual cost 
associated with equipment failures following an accident exceeds some stated 
amount, appears relatively small. However, the results indicate that, in 
view of the uncertainty with regard to many of the input parameters, further 
investigation appears warranted. In addition we have shown that the model 
results still exhibit some uncertainty in the high cost-low probability range 
where there is, of course, considerable interest. 

The model developed and reported on in this document provides an 
economical means of developing these additional required estimates for a 
variety of different sets of input specifications. 

Detailed analysis of the possible impact of accidents at Washington 
National Airport indicates an expected (average) annual impact of $110 for 
1985 and $1,200 for 1993. The 1993 results indicate the probability 
that the damage in any one year will exceed $100,000 is .0024, while for 
$1,000,000 it is .0001. There is some uncertainty with regard to many of 
the inputs that are necessary in treating this problem. If we assume that 
these uncertainties correspond to a factor of ten in the product of the amount 
of fiber released in the aircraft fire, the effect of downwind diffusion, 
and the intake into buildings, we estimate that the risk would then be 
approximately .01, that the annual impact would exceed $100,000 and .002 for 
exceeding $1,000,000. This amount of uncertainty in the factors associated 
with the problem is by no means unreasonable. 

The examination of worst-case accidents generated by the random 
selection of specific parameters clearly shows that effects of the accident 
leading to release of graphite fibers can be felt at considerable distances 
downwind from the accident site. For example, a simulated 1993 accident at 
Washington National Airport resulted in an impact greater than $4,000,000; 
more than half of this was due to the calculated effect on business and in- 
dustry in Baltimore. 
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The Individual airport risk is a function of the level of aircraft 
operations at the airport and the amount of business and industry at risk, 
that is, in the geographical area surrounding the airport. For 0 Hare Air- 
port at Chicago, the nation's busiest, for example, the expected (average) 
annual risk is $300 for the 1985 scenario and $2,700 for the 1993 scenario. 

The probability that the total impact will exceed $500,000 is .0002 for 1985 
and .0015 for 1993. For the 1993 case the probability is .0004 that the an- 
nual impact will exceed $1,000,000 and estimated as .00001 that is will 
exceed $10,000,000. 

These results may also be presented in terms of individual acci- 
dents; the average impact associated with aircraft accidents at O' Hare Air- 
port is estimated to be $18,200 for 1993, while 0.2 percent of the accidents 
had an estimated impact greater than $1,000,000. 

The results for the national risk profile indicate that the ex- 
pected annual national impact is approximately $2,800 for 1985 and $29,000 
for 1993. For the 1993 scenario we estimate that the probability of exceed- 
ing an annual national impact of $1,000,000 (in 1976 dollars) is approxi- 
mately .005 and decreases to .0001 for $10,000,000. 

This report describes the 0RI work in some detail. The following 
chapter describes the model in broad outline form. Chapter III describes the 
results obtained from the analysis of historical accident data, used to de- 
velop several of the model inputs. Chapter IV describes the sub-model de- 
veloped to predict the behavior of the plume resulting from a fire associated 
with an aircraft accident. Following this, we describe the methods used to 
model the downwind transport and diffusion of the fibers released at the 
accident scene, (Chapter V). Chapter VI discusses the transfer of fibers 
from the exterior to the interior of structures. In Chapter VII we present 
equipment failure models to treat particular segments of business and in- 
dustry. Next, in Chapter VIII, the methods for costing out the equipment 
failures are derived. 
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Results of the study are presented in some detail in the remaining 
sections of the report. Chapter IX describes the results for the Washington 
National Airport - Washington DC metropolitan area at several levels of 
detail, from an individual simulated accident to the statistics developed 
over many replications, including a description of the ten most costly 
accidents. Sensitivity of the results to major changes in the amount of 
composite material on board the aircraft is investigated. Chapter X presents 
additional results for the individual airport investigations; these include 
the comparison of several airports, and the discussion of statistical error 
bounds for the simulation results. Chapter XI describes the methods used 
to generate the national risk profile, presents the results and develops the 
associated statistical confidence limits. 
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II. OVERVIEW OF TECHNICAL APPROACH 


BASIC APPROACH 
Method 

The basic approach embodied in the ORI risk assessment technique 
is that of the Monte Carlo simulation. This method was essentially dic- 
tated by the following factors: 

• The problem is affected by many variables 

• It was difficult to identify in advance the values of these 
variables associated with the "worst cases." 

• It was important to obtain information about the statistical 
distribution of the results, and this is difficult to do 
analytically. 

The complete model, which is exercised in each simulation, comprises several 
individual modules. These form the backbone of the complete model as well 
as the structure for this report. 

The major problem elements are illustrated in Figure 2.1. Each is 
discussed briefly in this section of the report and then described in more 
detail in subsequent sections. Overlaying each accident-outcome calculation 
are several operations required to establish the conditions associated with 
the accident and to compute the desired statistics. These are illustrated 
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FIGURE 2 . 1 . MAJOR ELEMENTS OF RISK ANALYSIS SCENARIO 
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in the aggregate in Figure 2.2. For each sample, or replicated year, any 
fire accidents that occur with attendant release of graphite fibers are, 
simulated and their impact assessed. The year is replicated many times in 
order to develop probablistic estimates of the annual impact. 

Underlying Assumptions 

The ORI strategy described in this section makes use of several 
assumptions that are required for the implementation of the model. All 
aircraft in the time periods covered by the analysis are considered to be 
members of a limited number of categories, defined primarily by aircraft 
size. National historical accident data describing the relative frequency 
of an accident during particular operational phases are assumed to be appli- 
cable to all airports being analyzed in the future; the expected number of 
accidents at an airport is proportional to the number of operations. The 
geographical area surrounding the airport is defined in terms of a data 
base, primarily the County Business Patterns , which presents economic in- 
formation on a county-by-county basis. Each county is described for the 
model as a set of points, each of which is surrounded by a circle, such that 
the circles cover the county. The industry and households within the circle 
are assumed to be uniformly distributed over the area enclosed by the circle. 
Each type of business is defined, for purposes of calculating damage and its 
cost impact, by its two-digit Standard Industrial Classification code number, 
by which information is categorized in the County Business Patterns . 

AIRPORT-URBAN AREA RISK ASSESSMENT MODEL 

In this section each of the major model elements is described. 

These model elements and their interrelationships are illustrated in 
Figure 2.3. Each model element is described in order. The model can treat 
several airports in sequence, but the description here is limited to the 
processing of one airport. At the start of the calculation, the model is 
set up to run a given number of replications (samples); it takes the neces- 
sary actions to initialize for the first replication. After that, random 
samples are drawn and accidents occur, as described below. 
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FIGURE 2.3b. FLOWCHART 2 FOR ORI AIRPORT 
RISK ASSESSMENT MODEL 
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Generate Accident 


The computer model computes the number of accidents that will take 
place during the simulated year at this airport for each aircraft category. 
This calculation is a random process based on the assumption that the actual 
number of accidents is described by a Poisson distribution. The mean is 
estimated by taking the ratio of the number of operations of one type of air- 
craft at this airport to the total number of operations in the United 
States, and multiplying this ratio by the expected national annual accident 
rate. For generality, however, the complete model can consider all acci- 
dents, later deciding on the basis of reference to input data whether the 
accident led to a fire and possible release of graphite fibers. In the 
calculations reported here, we restricted our attention to accidents with 
fire. Further, we deal only with aircraft that have graphite composite 
material in their structures; therefore, the national accident rate used in 
calculating the expected number of accidents is the rate for graphite-fiber 
aircraft accidents with fires. Sample calculations of this rate, and com- 
parisons of random draws from the Poisson distribution with expectations 
are presented later in the report. 

Once the model computes the number of acci dents for the aircraft 
type being considered, we determine the operational phase during which the 
accident took place; this is a random assignment based on experiential data 
drawn from accident files at the National Transportation Safety Board. For 
each operational phase and aircraft type the model assigns an accident loca- 
tion, which is also a random draw from accident location distributions 
developed by analysis of the NTSB data. At the end of the accident genera- 
tion routine we then have the aircraft type, the operational phase during 
which the accident took place, and the associated accident location. The 
model is now ready to compute the subsequent movement of graphite fibers 
released in the fire that followed the accident, but first must determine 

certain associated variables, as described below. 

Compute Weather Details 

The actual weather conditions which are required as input to the 
model are the surface wind speed and direction, and the associated 
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atmospheric stability conditions. Fortunately, the joint distribution of 
these variables is available in a data base maintained at ORI under a joint 
EPA-FAA contract. This distribution is read into the computer for each 
airport being investigated. The probability distribution gives the frequency 
with which each combination of wind direction, wind speed range, and 
stability class occurred in the past. Some consideration was given to bias- 
ing this distribution towards poor weather conditions, since accidents are 
more likely to occur in bad weather than in good. After some discussion, 
the decision made was to consider all weather conditions, without bias in 
favor of poor weather conditions; it was estimated that the difference in 
final results would be less than a factor of two. With these weather data 
at hand, the model is ready to do the two calculations described next. 

Compute Plume Height 

At this step in the program, the model computes the height to which 
the fire plume will grow before stabilizing. This height is based on the 
aircraft class, the operational phase during which the accident took place, 
and the weather conditions selected earlier. It was recognized that many 
different random elements are present in this stage of the process, but, 
because of the uncertainty regarding them, we limited ourselves to using one 
set of stabilized plume heights for each combination of aircraft class and 
weather stability condition at the time of the accident. This method will 
tend to reduce the final variance, when compared to a wider range of plume 
height values. The aircraft size determines the size of the subsequent pool 
fire, or rate of energy release, which, with the meteorological stability 
condition, determines the behavior of the fire plume. 

Compute Downwind Exposure 

The model uses the weather details obtained earlier and the fire 
plume height generated in the last routine as inputs to the downwind ex- 
posure calculation. The other major input, which is the amount of graphite 
fiber released due to the fire is also determined here. Although the actual 
value is a random variable we have assumed that the fraction of the air- 
craft actually involved in the fire is fixed for each operational phase; the 
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fraction of fiber in the aircraft structure that is involved in the fire is 
assumed to be equal to the fraction of the aircraft that is involved in the 
fire. Further, we used the generally-accepted value of 20 percent of this 
fiber as the amount subsequently released as single fibers. These methods 
were adopted due to the unavailability of more precise aircraft-fire data; 
the use of probability distributions while introducing more variance would 
also have introduced more uncertainty and required more replications. The 
actual exterior exposure values are computed at points within a set of 
representative circles covering the region around the airport out to a range 
of at least fifty miles. This set-up is illustrated schematically in 
Figure 2.4 for a case in which one circle is used for an entire county; in 
many cases more than one circle was required. For each representative circle 
the model calculates the exterior exposure at the central point and at points 
two- thirds of the radius to the east, west, north, and south of the central 
point, in order to establish values representative of the area. The equip- 
ment failure and resulting cost impact calculations described below are 
also done for each of these points. The basic transport and diffusion model 
is characterized as a Gaussian plume model with some modifications. The 
principal modifications made were to include the effects of the fallout of 
the graphite fibers and partial reflection at the earth's surface. 

Compute Interior Exposure 

The model assumes that each residential unit and each type of busi- 
ness or industry at each of the key points for which the exposure is com- 
puted can be characterized by a typical building or type of enclosure. Each 
type of business-industry and each residential unit has associated with 
it a set of input parameters that determine how the exposure inside the 
building is related to the exposure outside the building. These values 
are developed from standard air conditioning and heating manuals. By refer- 
ring to these parametric values the model determines the exposure interior 
to typical buildings for each class of business or industry (or particular 
parts of these buildings if this is pertinent). This set of assumptions 
also tends to reduce variance, but is reasonable in terms of the introduction 
of uncertainty and associated computational requirements. 
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FIGURE 2.4. SCHEMATIC SHOWING LOCATION OF 
HYPOTHETICAL COUNTY RELATIVE TO AIRPORT 
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Compute Failures 

The model assumes that each individual vulnerable equipment obeys 
an exponential failure law. The Input structure for each business-in- 
dustry type describes the set of equipments within the typical building 
and the way they are related to each other. From the interior exposure 
values and the input failure parameters for each of these individual equip- 
ments the model computes the probability that an individual factory or 
business establishment in each category would have failed. Similarly, 
the probability that household equipment would have failed is computed 
for each typical household class at each of the characteristic points in 
the geographic area. This is done for all business-industry categories 
and types of residence at each characteristic location. 

Compute Cost 

For each residential unit the impact is estimated on the basis 
of the fraction of the equipments expected to be damaged and a standard 
repair cost. In the case of business and industry the impact is based 
on the assumption that all impact can be proxied by the likelihood that 
a complete failure would result in one day's lost business or production. 
The probability of failure of one type of business or industry is used as 
an estimate of the fraction of all businesses of that type near (within 
a distance of the order of R/3 as shown in Figure 2.4) that location that 
would have been affected. The model then allocates to each type of busi- 
ness its share, based on its fraction of the national payroll, of the Gross 
Domestic Product for that type of business. The estimated impact in 
dollars, at one point, is the sum over all businesses of the product of 
the Gross Domestic Product allocated to each business and the failure 
probability for that type of business at that location. The calculation 
is carried out for all points in the geographical area surrounding the 
airport. This is essentially an expected value calculation; for the 
airports of most interest, where business and industry are relatively 
dense this method is not expected to yield results that are significantly 
different from a completely randomized calculation, while saving con- 
siderable computational effort. 
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The computation of the interior exposure, resulting failures, and 
their cost impact — is done for all industries, and residential unit types 
at all of the pre-defined points within the circle representing a county or 
a portion of a county. Once the computations are made for one of the clus- 
ters representing a county or portion of a county, the model moves on to 
the next geographical area and its component circles. The computations 
are repeated there for that location's industries and residential units, 
using the value of exposure for that location. When all geographical areas 
have been completed, we have the estimate of the total cost impact of one 
accident. The model then determines whether it has finished processing all 
accidents that occurred in the simulated year (sample) for that aircraft 
type. If not, the next accident is processed exactly as described above 
until the total cost impact is generated. This is done for all the air- 
craft types considered for the year being simulated to obtain the total 
estimated impact of graphite fiber incidents during the year. The model 
then draws another sample by generating the number of accidents during 
another replication of the year under investigation. When the pre-set 
number of replications have been made the model has the information it 
needs to compute selected statistics over all samples. These include the 
frequency distribution of annual costs and the risk profile. Detailed re- 
sults describing the ten most costly accidents are also available. 

NATIONAL RISK PROFILE 

The total national risk can be estimated in several ways. One • 
method is to model the entire nation, at least as represented by some set 
of airports. The national model can be exercised in exactly the same way as 
the single airport model. The number of accidents in the country is gen- 
erated and accidents assigned to individual airports. A replication would 
consist of simulating the total national impact by adding the costs incurred 
at each of the representative airports. This method is considered 
relatively costly in terms of computational effort. Other methods would 
develop the individual risk profiles for a number of airports and then 
combine the risk profiles to prepare a national risk profile. One such 
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approach is a variant of the national model in which individual output re- 
sults are randomly drawn from distributions previously computed in single 
airport analyses. Another method is the straightforward combining of risk 
profiles previously obtained from individual airport analyses. This process, 
by which several probability distributions are combined to yield the prob- 
ability distribution of a new variable which is the sum of the individual 
variables, is a convolution. In order to develop individual airport results 
which are of considerable significance in their own right, en route to the 
national risk estimate, this is the method we adopted. 

A computational algorithm was prepared to perform the convolution, 
using as input the frequency distributions of the accident impact cost for 
several airports. This model can treat any number of airports to generate 
the probability distribution of total national cost impact: the national 

risk profile. If necessary, one airport can be convoluted with itself to 
estimate the impact of several similar airports. 
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III. AIRCRAFT ACCIDENT DATA 


Several factors associated with aircraft accidents are required as 
input to the risk assessment calculation. We need to determine the probability 
that an aircraft will catch fire during an accident near each airport of 
interest, since graphite fibers are only released as the result of a fire in- 
volving composite material. We need some description of the locations of 
these accidents, and the resulting fires, relative to the airport. We need 
some estimate of the fraction of graphite composite in the aircraft structure 
that will be involved in the fire, and the resulting amount of fiber that will 
be released in the size range that we expect to constitute a risk. Each of 
these aspects of the aircraft accident problem is discussed in this section 
of the report. 

AIRCRAFT ACCIDENTS INVOLVING FIRE 

Aviation accidents that have been reported by the National Transporta- 
tion Safety Board (NTSB) for the eleven-year period 1966 to 1976 were reviewed. 
The basic data source was the NTSB's Annual Review of Aircraft Accident Data , 
one volume for each of the eleven years. The Annual Review is published each 
year for commercial civil aviation (the certificated air carriers) as well as 
for general aviation. The scope of our investigation caused us to restrict 
attention to the coranercial aviation statistics only. Although the data are 
summarized in the annual reports, and although, the data are also available on 
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magnetic tape, it is still necessary to turn to more fundamental sources of 
information. 

Table 3.1 summarizes the gross statistics from the accident briefs 
as reported in the NTSB's Annual Review series. A total of 594 accidents was 
reported in the course of the eleven years, and of these, 136 involved fires. 
That is, 23 percent of the reported accidents involved fires. 


TABLE 3.1 

SUMMARY OF U.S. AIR CARRIER ACCIDENTS 1 


Year 

No. of Accidents 
Reported 

No. of Accidents 
with Fire 

1966 

75 

13 

1967 

70 

21 

1968 

71 

17 

1969 

63 

6 

1970 

55 

16 

1971 

48 

11 

1972 

50 

14 

1973 

42 

9 

1974 

47 

12 

1975 

45 

9 

1976 

28 

8 

TOTALS 

594 

136 


It is possible to draw a trend line through these data, as some inves- 
tigators have, and show that the number of accidents per year will approach zero 
within a few years. We have taken a more realistic approach and assumed that 
there will always be some accidents. The actual number would realistically be 
a function of many variables, for example, the experience associated with the 
introduction of new aircraft. In view of these considerations, we have assumed 
that the total number of accidents involving fires in the United States will 
"level off" at six per year. This combines the well -documented downward trend 
with the notion that the number is not likely to reach zero. We have retained 


I NTSB, Annual Review of Aircraft Accident Data, 1966-1976. 
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this estimate throughout the calculations, using it both for the 1985 and 
1993 scenarios. With expected increases in air traffic during the inter- 
vening years, this implies a continued decrease in the national aircraft 
accident rate, but avoids the introduction of one more variable parameter 
into the comparison of our results for 1985 and 1993. 

In the simulation model described later in the report it was neces- 
sary to allocate an appropriate fraction of the six fire accidents estimated 
to occur nationally to each airport being processed. For this allocation we 
assumed that the expected number of accidents at an airport in one year is 

given by the expression: 

Number of operations at this airport x g 
Total number of operations in the U.S. 

Further, rather than estimate the number of accidents nationally for 
each aircraft type we are concerned with, we chose to apply essentially the 
same relationship for each aircraft type. That is, the expected number of 
accidents involving fires for a specific type of aircraft is obtained by multi- 
plying the expected number of accidents at the airport by the ratio of opera- 
tions at the airport by the aircraft type of interest to all operations at the 
same airport. This is equivalent to replacing the numerator above by the number 
of operations of the specific aircraft type at the specific airport. 

To summarize, then, the expected number of accidents at the airport 
is assumed to be proportional to the number of operations at that airport. In 
a separate analysis we demonstrated that more than 70 percent of the variance 
in the accident distribution was accounted for by the number of operations. For 
the purposes of this study, in view of the questionable accuracy of many of the 
other inputs, we considered this result sufficient confirmation of the proposed 
method. 

In the ORI Risk Assessment Model the number of accidents in any sample 
is obtained by making a random draw from a Poisson distribution. The probability 
of exactly k accidents with fire in a year at one airport involving a particular 
class of aircraft with carbon fiber is given by: 

p( k;x) = e~ X k (3.!) 

k: 
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where X is the mean annual fire-fiber accident rate at the airport. That is, 

X given by: 

No. of operations at airport, aircraft category of interest x 6 x (3.2) 
Total U.S. operations, all commercial aircraft 
Fraction of aircraft in category with fiber 

The Poisson distribution is often used for estimating accident incidence and 
other related random events. The distribution, because of its special utility 
in this regard, was once known as the "law of small numbers or rsre events. 

FRACTION OF AIRCRAFT CONSUMED BY FIRE 

In examining the data describing accidents accompanied by fire in the 
NTSB Annual Reviews, as well as tabular summaries generated by the accident 
abstracts included in the NTSB-prepared computer tape, we determined that 
many of the details necessary at this stage of the analysis were not avail- 
able in these two media. It was necessary to review more basic accident data, 
much of which was available at the NTSB Headquarters. In particular, it was 
necessary to develop estimates, for future input to the computer, of the 
fraction of an aircraft that might be consumed by fire following an accident. 

It was particularly desirable to relate these estimates to aircraft type, if 
feasible, and operational mode during which the accident took place. It was 
clear from a preliminary review of the summary data that many of the accidents 
accompanied by fire might be such that liberation of graphite fibers could not 
reasonably be expected. 

The NTSB maintains two data sources that are "more basic" than the 
published annual summaries or the tabulated summary data: the Aircraft Accident 

Reports (known as the "Blue Books") and the actual file of raw accident data 
containing on-the-spot reports from many sources. It was possible to review 
several years' worth of accidents involving fires with the aid of the informa- 
tion in these two sources. Unfortunately, some earlier accidents with little 
damage did not rate the preparation of a "Blue Book," while several that had 
been prepared were no longer available. Our concern for problems of inhomoge- 


2 W. Feller, 1950. An Introduction to Probability Theory and Its Application , 
John Wiley, New York, P 158 et seq. ™ 
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neity of the data associated with going too far back in time led us to forego 
the hunt for accident files earlier than those maintained at the NTSB Head- 
quarters. Accordingly, our review of raw accident data spanned the years 1972 
through 1976. We covered those accidents that had previously been identified 
as accompanied by fire or explosion. This comprised a total of 52 accidents 
that had been identified in the Annual Reviews for these years. In the "Blue 
Books" and the basic accident files we were able to find 34 of these. A sum- 
mary of our findings with regard to the possibility of graphite fiber release 
as a result of the accident appears below. Here we have indicated the number 
of "possibles" out of the total number of fire accidents reviewed. The scoring 
of "possible" means that, in the judgment of our accident review team, graphite 
fibers might have been released in the accident, given that there were fibers 
in the structure of the aircraft. Of course, no fibers were released in any 
of these accidents since there were none present. The preliminary results were: 

• 1972 -- Six accidents reviewed; six possibles 

• 1973 -- Seven accidents reviewed; six possibles 

• 1974 — Seven accidents reviewed; five possibles 

• 1975 -- Six accidents reviewed; two possibles 

• 1976 — Eight accidents reviewed; six possibles. 

In summary, 25 out of the 34 accidents involving fire for which detailed data 
were available, were judged to be potential graphite fiber release accidents. 

Some of the details underlying the exclusion of specific accidents 
from the "possible" category are worth noting. Brief accounts of these ex- 
cluded fire accidents, focusing on the reasons for deciding that they would 
not lead to graphite fiber release, follow: 

• 1973 -- Aircraft ran off the runway after landing. A small 

fire in the right engine was extinguished by the aircraft's 
own fire-extinguishing equipment. 

• 1974 An in-flight fire in the number two engine was extinguished by 

the engine's own fire bottles. 

— An accident was found to be caused by an explosion due to 
sabotage. There was no fire. 
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• 1975 -- Prior to take-off there was a fire due to overheated 

wires; extinguished and aircraft resumed operation. 

-- Prior to take-off the number-3 engine caught fire. The 
fire was put out "immediately" by ground mechanics. 

— A flash fire In the area of the tail pipe of the num- 
ber-1 engine was under control in seconds. The fire 
effects were limited to the landing gear tires and wheels. 

— Fire prior to take-off was limited to the APU and lasted 
only 5 to 10 seconds. 

• 1976 -- In-flight fire in number-2 engine was self-extinguished. 

-- The use of a power carbide saw by rescue personnel caused 
a fire. The fire was extinguished in seconds. 

AMOUNT OF GRAPHITE FIBER RELEASED 

The number of graphite fibers that might be released as a result of an 
aircraft accident involving fire depends on several factors. Among the more 
obvious factors are how much graphite fiber material (more precisely, perhaps: 
how much composite material, and what fraction of the composite is graphite 
fiber) is used in the aircraft structure, and how much of the composite material 
is actually involved in the fire. If the composite material is used in identifi 
able parts of the aircraft, the factors of particular interest to us are whether 
that portion of the aircraft would be involved in a fire resulting from an acci- 
dent, and, if involved, what fraction of the fiber therein would be liberated. 

As part of NASA's Aircraft Energy Efficiency (ACEE) program, the avia- 
tion industry is currently developing a number of aircraft structure components 
using graphite fiber composites. Components including rudder, ailerons, and 
elevators could be used in 1980-1983 production aircraft. Structures such as 
the vertical fin and the horizontal tail will probably not be in production be- 
fore 1983. There is apparently no current development program to apply carbon 
composite materials to the wing structures of production commercial aircraft. 
Such composite structures are not expected to be available before 1985, at the 
earliest. Composite wing structures for aircraft about the size of the DC-9 


3-6 



or the Boeing 727 might contain about 1,800 kilograms of carbon epoxy composite 
material. We have noted, for example, that in several accidents the tail 
section was separated from the rest of the aircraft during the early stage of 
the accident. If all of the composite material in such an aircraft were in the 
tail structure, and the fire were confined completely to the main fuselage, then 
no graphite fiber would have been released in those accidents. A parallel 
study by the air frame manufacturers is underway to provide more details of the 
type outlined above for past accidents. 

At present, with future applications of composite material not completely 
firm, and the detailed data describing involvement of specific aircraft structural 
elements in fires resulting from accidents unavailable, we have made an assump- 
tion equivalent to: the composite material is used uniformly throughout the air- 

craft structure. The actual amount of graphite contained in composite material 
projected for aircraft by aircraft size (type) is shown in Table 3.2. These values 
were developed collectively by NASA, Boeing, McDonnell -Douglas, and Lockheed, 
and were essentially adopted by ORI and other investigators as standard values 
for the Phase I risk assessment calculations. Our basic assumption is that if 
one-half of the aircraft is involved in a fire, one-half of the composite 
material on board is involved in the fire. Table 3.2 also shows the fraction of 
commercial aircraft in each size category that is expected to have graphite 
composite material in their structure. Further, the available data reported by 
other NASA/Langley-sponsored investigators suggest that about 20 percent of the 
carbon in that composite material will actually be released as single short 
fibers in the size range that poses a threat to electric and electronic equip- 
ment downwind. Again, this 20-percent factor was adopted as standard for all 
calculations. 

FRACTION OF AIRCRAFT CONSUMED BY FIRE 

Table 3.3 summarizes the available information for each of the aircraft 
fire accidents reviewed by the ORI team. For each accident the table shows the 
operational phase during which the accident took place, the weather at the 
accident site, the amount of fuel on board, the duration of the fire, the 
extent of damage as estimated by the NTSB investigators, and the fraction of 
aircraft structure consumed in the fire, as estimated by the ORI accident review 
team. In each case we have reported the original NTSB file number which enables 
any investigator to retrieve the complete docket for that accident. 
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TABLE 3.2 

PROJECTED FUTURE USE OF CARBON FIBER IN 
COMMERCIAL AIRCRAFT 



rt r*, rw+\/ 

1985 

1993 

Ai rc 

:ratt category 

Fraction 

Carrying 

Fiber 

Fiber 

Per Aircraft 
(Kilograms) 

Fraction 

Carrying 

Fiber 

Fiber 

Per Aircraft 
(Kilograms) 

Size 

Current Examples 

Large 

DC-10, L-1011 , 747 1 
727, 757, 767, 707 

.33 

454 

.50 

2041 

Medium 

DC-8 

.20 

136 

.60 

680 

Small 

737, DC-9 

.33 

91 

: 

.50 

454 


The ORI estimates of fraction of structure consumed by the fire were 
based on the narrative reports prepared by NTSB investigators, and the ex- 
amination of all relevant data in the complete accident file, which occasion- 
ally included photographs. One finding is that, in all cases examined, some 
portion of the aircraft escaped complete destruction by fire. As an example 
of how the fraction of aircraft consumed was estimated, consider the 1976 
accident with file number 1-0020 (cf. Table 3.3). 

The following is an excerpt from a 1976 accident "Blue Book." 3 

"Fire erupted in the left side of the aircraft after the left 
main landing gear traversed the ditch and severed the left 
main landing gear's attaching structure on the left main fuel 
tank's rear bulkhead. Fuel escaped from this tank, burned and 
caused massive damage to the left side of the fuselage and in- 
board section of the left wing. The cabin interior was damaged 
heavily throughout by smoke and soot." 


3 National Transportation Safety Board, Aircraft Accident Report, Texas Inter- 
national Airlines, Inc., Douglas DC-9-14, N91 04, Stapleton International Air 
port, Denver, Colorado, November 16, 1976, Report Number NTSB-AAR-77-10. 
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TABLE 3.3 

SUMMARY OF AIRCRAFT FIRE-ACCIDENT DATA 


YEAR 

FILE NO. 

A/C TYPE 

OPERATIONAL 

■■■ 

FUEL ON BOARD 

fire duration 

AIRCRAFT STRUCTURE 

DAMAGE 

PHASE 


(POUNDS) 


CONSUNEU (PERCENT )* 

EXTENT f 


1-0002 

DC-9 

Landing 

rain 

NR 

3 min. 

50 

Destroyed 


1-0003 

DC-9-14 

Landing 

Go-around 

none 

22,000 (jet A) 

NR 

80 

Destroyed 


1-0005 

CY-580 

In-flight, 

none 

NR 

NR 

30 

Destroyed 

1972 

OHC-6 

cruise 

30 

Oesttoyed 


1-0016 

1-1011 

In-flight 

none 

43,000 

flash fire 

10 

Destroyed 


1-0017 

DC-9 

Take-off. 
Initial climb 

fog 

22,000 {jet A) 

19 min. 

60 

Destroyed 


1-0048 

B-737 

Final Approach 

fog 


20-30 min. 

SO 

Destroyed 


1-0011 

DC-9 

Final Approach 

fog 

13,000 

20 min. 

80 

Destroyed 


1-0015 

DC- 8 

Take-off 

NR** 

NR 

NR 

10 

Minor 

1973 

1-0017 

CV-600 

In-flight 

rain 

NR 

NR 

20 

Destroyed- 

1-0018 

DC- 8 

Landing 

drizzle 

70,000 


70 

Destroyed 

" 

1-0019 

B-737 

Landing 

rain 

NR 

% 0 

% 0 

Substantial 


1-0026 

DC-10-30 

? 

rain 

182,000 

> 3 min. 

40 

Substantial 


1-0041 

F11227B 

Landing 

rain 

4,830 (jet A) 

NR 

20 

Destroyed 


1-0001 

B-707 

Landing 

rain 

69,000 

> 14 min. 

90 

Destroyed 


1-0008 

Lockheed 

In-flight 

rain 

40,500 at 

NR 

60 

Destroyed 


382 


take-off 





1-0012 

B-707 

Landing 

fog 

hydraulic fluid 

25 min. 

60 

Destroyed 

1974 


burned 





1-0013 

DC-10 

Climb to cruise 

NR 


0 

0 

Substantial 


1-0020 

DC- 9- 31 

Landing 

fog 


10 min. 

80 

Destroyed 


1-0024 

B-707 

In-flight 

clear 


No fire - explo- 
sive device 

80 

Destroyed 


1-0029 

B-727 

Landing 

rain 



80 

Destroyed 


1-0002 

B-727 

Parked 

NR 



Wiring Overheated 

Substantial 


1-0006 

B-727 

Landing 

rain 

11,300 

8 min. 

50 

Destroyed 

1975 

1-0019 

1-1011 

Starting Engines 

NR 

NR 

NR 

0 

None 

1-0029 

B-727 

Taxi 

fog 

NR 

12 min. 

20 

Substantial 


1-0032 

DC-10 

Take-off 

haze 

155,000 

•u sec. 

0 

Substantial 


1-0037 

DC-10 

Taxi 

rain 

■ NR 

NR 

0 

None 


1-0003 

B-727 

Landing 

fog/snow 

35,000 

4 hrs. 

50 (classic 

Destroyed 








bent-over plume) 



1-0005 

B-727 

Landing 

clear 

14,100 

40 min. 

80 (plume sev- 

Destroyed 







eral 100 ft high) 



1-0009 

L-1011 

Descending 

NR 

NR 

■ NR 

0 

Substantial 

1976 





(electrical fire) 


1-0012 

B-727 

Take-off 

dear 

NR 

NR 

10 

Substantial 


1-0015 

DC-6 

Take-off 

rain 

9,600 

(av. gasoline) 

n. sec. 

0 

Destroyed 


1-0020 

DC-9 

Take-off 

dear 

18,300 

7 min. 

15 

Substantial 


1-0024 

DC-10 

Landing 

NR 

NR 


20 

Substantial 


1-0025 

L-188 

Landing 

NR 

(5,000 gallons 
transported) 

1 day 

SO 

Destroyed 


• Estimated by OR l accident review tew 
t Estimated by NTSB accident team 
NR Hot reported 
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In addition, other reports in the investigative file showed that the fuselage 
was burned through on the left side in the area of the left wing roots. The 
left wing root and fairing were burned. The left ovennng exist was almost 
completely consumed by fire. In this Instance, the Investigative file con- 
tained the statement that about 25 percent (such percentages are rarely given) 
of the fuselage on the left side was consumed in the fire, which was extin- 
guished in 7 minutes. This led to the ORI team's estimate of 15 percent over- 
all fire damage to the aircraft. The NTSB report characterized the damage 
to the aircraft as, "substantial ." 

We were clearly interested in the relationship of the fraction of 
aircraft destroyed by fire and the operational phase. Due to the limited data 
some aggregation was done in seeking to establish this relationship. In the 
"take-off" category we included taxi prior to take-off as well as ascent to 
cruise level. In "landing" we included descent from cruise level and taxi 
after landing. The intent was to separate the operation of the aircraft into 
time categories that would segregate periods when there were large amounts 
of fuel on board (take-off) from those with relatively little fuel (landing). 
Of the 34 accidents with fire that were reviewed in detail, we were able to 
classify 17 as "landing" accidents and 7 as "take-off" accidents. The re- 
mainder were either unassignable due to data gaps, or clearly not in these 

operational phases. 

Based on our analysis of the data summarized in Table 3.3 and these 
definitions, we estimated the distribution by operational phase of accidents 
involving fires that could potentially result in the release of graphite 

fibers to be: 

• Static — 0 

t Taxi — 0 

• Take-off -- 20% 

§ In-Flight - 20% 

• Landing — 60% 

These results are discussed further below. 
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The data indicate that the fraction of aircraft consumed by fires 
during landing accidents is significantly greater than for take-off acci- 
dents. The estimated median fraction of aircraft consumed. is 50 percent for 
landing and 20 percent for take-off. This suggests that the amount of fuel 
on board, typically far less on landings than on take-offs, is not critical 
to the determination of consumption by fire. More Important, perhaps, is 
the impact associated with an emergency landing and the higher probability 
of the crash being off the airport resulting in decreasing accessibility for 
fire and rescue equipment. The fraction-of-aircraft-consumed data for in- 
flight accidents were even more sparse than indicated earlier. As a rea- 
sonable value based on the few documented cases, we selected the value of 
30 percent of the aircraft Involved in fire for accidents occurring during 
the in-flight phase. 

FIRE DURATION 

Another question of Interest is the duration of any fire resulting 
from an aircraft accident, and its relationship to phase of operation. The 
frequency data for fire duration following landing and take-off accidents 
from the NTSB reports indicate that the median fire duration is 20 minutes 
for landing accidents and 2.5 minutes for take-off accidents. The data set 
is extremely limited, implying that relatively little confidence can be 
placed in the numerical results, but longer durations for landing accidents 
are consistent with the earlier finding of greater consumption by fire in 
landing accidents. The frequency distribution based on the cases available 
is shown in Figure 3.1. 

The conclusion based on necessarily restricted analyses of limited 
data is that the fire hazard, and consequent release of graphite fibers, 
is greater for landing than take-off accidents. There are considerably 
more landing accidents with fire than take-off accidents with fire; the 
percentage consumption by fire is considerably greater for landing accidents 
than take-off accidents; and, probably correlated with the previous finding, 
landing-accident fires last longer than take-off accident fires. 
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FIGURE 3.1. FREQUENCY DISTRIBUTION FOR FIRE DURATION 
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Stanford Research Institute (SRI) has written a detailed report 
which also characterizes aircraft accidents involving fires. 4 The period 
for which they studied the accident data was 1963-1974, whereas we generally 
reviewed data for 1966 to 1976, and concentrated our analysis on 1972 to 
1976. Their reported distribution of accidents involving fire over opera- 
tional phase is consistent with ORI's findings. Landing accidents pre- 
dominate, and the static and taxi phases are relatively insignificant con- 
tributors to the overall accident set. 

The SRI study, like the basic NTSB data source, gives degree of 
destruction by fire only in the qualitative terms: destroyed, substantial, 
minor, and none. Thus, it is not possible to use SRI findings to supple- 
ment ORI's numerical estimates of percent of aircraft destroyed by fire. 

AIRCRAFT ACCIDENT LOCATIONS 

In developing the distribution of aircraft accident locations we 
separated the categories of in-flight and landing accidents which we had 
tended to lump in the analysis discussed to this point. We recognized, as 
will be shown later, that true landing accidents tend to be nearer the 
airport and in-flight accidents tend to be distributed over greater dis- 
tances from the airport. 

Table 3.4 gives the proximity to the "nearest runway of the air- 
port" for 33 accidents involving fire that occurred in the years 1972 to 
1976.* One accident that had been included in some of the earlier analyses 
was in fact an explosion due to sabotage (without fire) and it was decided 
to exclude it from this portion of the analysis. Only two of the 33 acci- 
dents involving fire took place under "static" conditions and two took 
place during the "taxi" phase. This supports our decision to simplify the 
analysis by assigning zero probability to accidents involving fire during 
the static or taxi phases. Further, it seems very unlikely that "on- 
airport" fires during these operational phases would be allowed to burn for 
more than a few seconds before fire-fighting equipment came to extinguish them. 


44 An Analysis of Aircraft Accidents Involving Fires," G.V. Lucha, M.A. 

Robertson, and F.A. Schooley, SRI, May 1975, NASA CR 173690. 

*Note that miles are used as the units because this is how original data 
are reported. 
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TABLE 3.4 

AIRPORT PROXIMITY FOR AIRCRAFT ACCIDENTS WITH FIRE* 


YEAR 

FILE NO. 

DISTANCE FROM 
AIRPORT 
(MILES) 

OPNL PHASE 

YEAR 

FILE NO, 

DISTANCE FROM 
AIRPORT 
(MILES) 

OPNL 

PHASE 


1-0002 

0 

L 


• 1-0002 

0 

S 


1-0003 

0 

L 


1-0006 

<h 

L 


. 1-0005 

>5 

I/F 


1-0019 

0 

S 

1972 

i 

1-0016 

>5 

I/F 

1975 

1-0029 

0 

T 


1-0017 

0 

T/0 


1-0032' 

0 

T/0 


1-0048 

<2 

L 


1-0037 

0 

T 


1-0011 

0 

L 


■ 

1-0003 

0 

L 


1-0015 

0 

T/0 


1-0005 

0 

L 


1-0017 

>5 

I/F 

i 

1-0009 

>5 

I/F 

1973 

1-0018 

>5 

L 

1976 

1-0012 

0 

T/0 


1-0019 

0 

L 


1-0015 

<1 

T/0 


1-0026 

0 

L 


1 

0 

T/0 


1-0041 

<3 

L 


I 

0 

L 



. 

— 


1-0025 

0 

L 


1-0001 

0 

L 





1. 

? 

I/F 

Legend: 



1974 


0 

L 

L = Landing 



1-0013 

>5 

I/F 

T/0 = Takeoff 



1-0020 

<4 

L 

I/F = In-flight 



1-0029 

>5 

L 

T = Taxi 




* 34 accidents from 1972 to 1976 previously selected for damage analysis, but one case of sabotage 

explosion dropped. Distances are to nearest runway of the airport. 







Six of the reported accidents with fire took place during the 
take-off phase. As Table 3.4 shows, five out of six took place on the run- 
way (distance to runway was zero miles) and the sixth took place less than 
a mile from the runway. It seems logical that take-off accidents will either 
occur on the runway or just beyond the end of the runway. Lacking speci- 
fic data, we have assigned uniform probability for locations of take-off 
accidents with fire from the beginning of the runway to a distance of one 
mile beyond the far end of the runway. 

Seventeen of the accidents with fire were landing accidents. Eleven 
of these took place on the runway. The remaining six were distributed as 
follows: 

1 within 1/4 miles of the runway 

1 within 2 miles of the runway 

1 within 3 miles of the runway 

1 within 4 miles of the runway, 

while 2 were more than 5 miles away from the end of the runway. 

Thus, combining the one landing accident that was within one-quarter 
mile of the runway with the eleven that were on the runway, we conclude 

that approximately two-thirds of all landing accidents with fire occur on 

the runway. For computer modeling purposes, we assume that these acci- 
dents are distributed uniformly along the runway with a total probability 
of two-thirds. Since we have no data to distinguish undershoots from over- 
shoots, we arbitrarily assume landing accidents are equally likely to be 
undershoots or overshoots with probability equal to one-half for each type. 
Based on the crude proximity data for the sample of six landing accidents 
that occurred off the runway we assign the off-runway accidents uniformly 

within a six-mile band short of the runway and another six-mile band just 

beyond the runway. 

Of the six in-flight accidents with fire reported in Table 3.4, the 

site of one is not given, and the other five all took place at distances 

greater than five miles from the airport runway. We have assumed symmetry 
so that half the in-flight accidents end up short of the runway and half 



beyond the runway. We Impose a five mile zone just short and just long of 
the runway where no in-flight accidents occur. And then we assume there 
is a 15-mile band beyond the five mile zone where the in-flight accidents 
do occur with uniform probability. 
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IV. FIRE AND RELEASE OF GRAPHITE FIBERS 


The graphite-fiber release starts with an aircraft accident leading 
to a fire. The "typical" accident envisioned is fed by the aircraft fuel. 

As a result of the fire some fraction of the aircraft is consumed. Chapter III 
reviewed the correlation between aircraft operational phase (take-off, landing 
etc.) and the amount of damage caused by fire. It was noted that official 
sources, such as the National Transportation Safety Board, do not prepare 
quantitative estimates of the amount of damage caused by fire and, of course,, 
there is essentially no information available on the amount of composite 
material that would be involved in the fire. 

In the absence of detailed estimates of future use of carbon fiber 
composite material in commercial aircraft components, we introduced the assump- 
tion that the fraction of composite material in the aircraft structure that 
would be involved in the fire is equal to the estimated fraction of the 
aircraft involved in the fire. This is essentially equivalent to assuming 
that the composite material is used uniformly throughout the aircraft. 

Further, as described in Chapter III, it is expected that 20 percent, by 
weight, of the carbon in the composite material would be released as single 
fibers in the size range of interest during the fire. These assumptions 
reduce the variance of the final results, but some insight into their impact 
can be obtained from the sensitivity tests reported in Chapter IX. 
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As a consequence of the fuel -fed fire a hot buoyant plume is formed 
that rises to a "stabilization" height which is a function of the energy avail- 
able to feed the fire, the wind speed, and the atmospheric stability. The 
released graphite fibers enter the buoyant plume and travel to the stabili- 
zation height, which is reached at a particular downwind stabilization distance. 
The solution to the physical problem of the rise of the buoyant plume was 
formulated by Gary Briggs. The results appear in the next section. 

PLUME HEIGHT CALCULATION 

Calculation of the plume rise (or elevation), H, at stabilization from 
an open fire follows the work of Briggs. 1 The height of the plume, in meters, 

is given by: 

H = 2.9(F/us) 1/3 . (4.1a) 

for stable conditions, where u is the mean wind speed in meters per second. 

For neutral or unstable conditions we have 

H = l.eF^Vy/ 3 , when x <3.5x* (4.1b) 

H = 1.6F 1/3 u" 1 (3.5x*) 2/3 , when x >3.5x* (4.1c) 

where : 

x* = 14F 5/8 , when F < 55 
x* = 34F 2/5 , when F > 55 

The buoyancy flux parameter F, appearing in the above equation, is given by 

, 9QR 

v T 


1 Some Recent Analyses of Plume Rise Observations , Gary A. Briggs, paper presented 
at the 1970 International Air Pollution Conference of the International Union 
of Air Pollution Prevention Associates. 
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where: 


g = acceleration of gravity, 9.8 m sec - ^ 

Qr = heat emission rate, kcal sec" 1 

C = specific heat of air at constant pressure, 
P 

0.2391 kcal kg“ 1 (°K)' 1 

_3 

p = atmospheric density, 1.293 kgm 
T = ambient temperature, (273.2 + temp °C)°K. 
The atmospheric stability parameter, s, is defined by: 


where : 

H* = gradient of potential temperature, O.SS^m" 1 
for stable conditions (value appears in CRSTER 
code for subroutine BEH072). 2 

In order to use the Briggs formulas, we must specify Qr, the heat 
emission rate for a burning aircraft. For this specification we are indebted 
to Bart Bartram of NUS Corporation. 3 Bartram has shown that Q R may be approxi- 
mated by: 

Q r = RApE t 4 - 2 ) 

where : 

R = fuel burning rate, 0.047 ft/mi n 
A = fuel dispersion area, 481.74 ft 2 
p = fuel density, 48.7 lb/ft^ 

E = fuel heat content, 18,400 BTU/lb 


2 User ’s Manual for Single-Source (CRSTER) Model , ERA, July 1977, EPA-405/2- 

77 - 013 ”; ; 

3 Unpublished Communication, 1978. 
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The fuel burning rate was determined empirically by Los Alamos Scientific 
Laboratories for JP-4 jet fuel 4 ; more recent experiments conducted by NASA, 
reported after the ORI calculations were complete, indicate that this value 
may be too high, by as much as a factor of two (cf. the following section, 
"Layer Penetration.") The fuel dispersion area is an estimate of the area 
below the wing tanks on a B-737 aircraft. Using these data we find that 
Q r = 3.3575 x 10 5 BTU sec" 1 (or 8.4614 x 10 4 kcal sec" 1 ) for a B-737 type 
aircraft. 


Substituting the above values, we find that Equation (4.1a) becomes 
^B-737 = 4( ^ f° r stable air at 70° F and = 380 u -1 ^ for stable 
air at 20° F. For unstable or neutral conditions, at either 20° or 70° F, 


equations (4.1b) and (4.1c) become H 3.737 = 4800 u 


-1 


Since the B-737 is designated as a small transport type, we need a 
means to extend the plume-rise calculations to medium (707- type) and large 
(747-type) transport aircraft. We note in Equation (4.1) that H is proportional 

to F^ 3 for stable conditions and F is directly proportional to Q D . It follows 

1/3 K 

that H is therefore proportional to Qr . 


Equation (4.2) shows that Qr is proportional to the area of the burning 
pool, the fuel deposited on the ground from the airplane's fuel tanks. For the 
B-737, a small transport type, the fuel dispersion area was set equal to the 
area below the wing tanks. Since the wing tanks comprise most of the wing 
structure, excluding ducts along the leading edge and control surfaces and 
voids in the trailing edge, this area is proportional to the area of the wing. 
Further a wing chord is typically approximately proportional to the wing span, 
so that the area subtended by the fuel tanks may be considered proportional to 
the square of the wing span. We have used this proportionality relationship 
in extrapolating Equation (4.2) to other aircraft. It then follows that the 
maximum plume height obeys the relationship: 

H = K(wing span) 2 / 3 . 


Then the height of the plume for any aircraft fire, H/^, can be obtained from 
the height calculated for a B-737 aircraft, given by Equation (4.1) (defined 

4 R. K. Clarke, et al., 1976. Severities of Transportation Accidents. Sandia 
Laboratory, SLA-74-001. ' 
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as H 737^* In sta ^ e atmospheric conditions the result is: 

ing Span) AC n 2/3 


H AC " H 737 


'(Wing Span) AC ‘ 
(Wing Span) 737 


In unstable or neutral conditions H is proportional to: 
pl/3p4/15 = p3/5 


Then H may be estimated from: 


H AC = H 737 


(Wing Span) AC " 
(Wing Span 27 


6/5 


These relationships thus enable us to determine plume rise for accidents 
involving different aircraft for any combination of wind speed and stability 
conditions. Typical values of the calculated plume heights under different 
conditions are given in Table 4.1. 


LAYER PENETRATION 


It is pointed out in Chapter V that there are occasions when the 
calculated plume rise is greater than the mixing layer height. When these 
cases occurred in the simulated accidents the plume height was set equal to 
the layer height. That is, "punching through" was forbidden. In the "real 
world," whether punching through occurs is problematic. For instance, 

L. Lavdas, of the Forest Service, has suggested that it is unlikely. 5 On 
the other hand. Table 4.2 from Pasquill 6 shows, for a limited set of data, 
instances of both penetration and nonpenetration of inversions. The values 
of Qr are of the same order of magnitude as those that concern us here. The 
bottom of the inversion as shown in Table 4.2 is the mixing layer height, as 
the term is used in this report. 

It would be important to evaluate the "punch through" or penetration 
problem with greater care if the graphite- fiber problem turned out to be 


5 Letter from Lavdas, USDA, Forest Service, Macon, 6a., to R. Greenstone, ORI, 
Inc., 26 October 1978. 

6 F. Pasquill, Atmospheric Diffusion (2d edition), John Wiley & Sons, New 
York, 1974. 
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TABLE 4.1 


TYPICAL PLUME HEIGHTS (METERS) 
(MODERATE WIND SPEED = 10 m/sec) 


Aircraft 

Category 

Wing Span 
(meters) 

Stability Condition 

Stable 

Neutral/ 

Unstable 

Large 

59 

257 

685 

Medium 

44 

180 

480 

Small 

29 

108 

289 
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TABLE 4.2 - 

DATA ON PENETRATION OF INVERSIONS BY HOT PLUMES 
After Briggs (1969) 


Date 

Time 

Qr 

(10 7 cal/sec) 

u 

(m/sec) 

Plume 

Height 

Cm) 

Inversion height (m) 

Penetration ? 

Bottom 

Top 

May 25 

1825 

1.97 

9.0 

295 

145 

180 

Yes 

July 20 

0552-0559 

0.98 

10.5 

350 

325 

255 

475 

275 

No 

Yes 


0617-0820 




365 

395 

No 

July 21 

1.11 

7.3 

360 

540 

580 

No 

0600-0724 

1.13 

4.3 

360 

410 

450 

1 1 V 

No 


0828 

1.64 

2.7 

510 

240 

280 

Yes 

September 8 

0648-0930 

1.66 

7.5 

410 

360 

360 

410 

400 

Yes 

? 


1000-1020 

1.77 

5.4 

560 

620 

650 

No 


0640-0705 

1.20 

9.6 

350 

360 

400 

No 


0747-0850 

1.54 

9.1 

370 

260 

300 

Yes 

September 9 

0930-1000 

2.13 

9.6 

390 

370 

420 

410 

530 

- . 

No 

No 


Source: F. Pasquill, Op.Cit 



severe. Our model of the physical processes involved in fiber transport tsee 
Chapter V) indicates that there will be no graphite fiber at the ground as 
long as the plume is above the layer. The plume stays above the layer until 
its center of gravity drops through as a result of gravitational settling of 
the fibers. This phenomenon is represented by the tilted-plume model we have 
adopted, as described in Chapter V. 



V. DOWNWIND TRANSPORT AND DIFFUSION OF FIBERS 


MODEL SELECTION 
Background 

For this risk assessment study we wished to use a downwind trans- 
port and diffusion model that captured all of the significant physical elements 
of the problem. At the same time we wanted a model that could be easily 
adapted to our use. We hoped to use one that required a relatively small amount of 
input meteorological data and was relatively modest in its requirements for 
computer time. In examining relatively sophisticated models we recognized 
the associated liabilities in terms of cost associated with data prepa- 
ration and computing timei We also concluded that this model need not provide 
results that were significantly more accurate than those that could 
realistically be expected from other parts of the complete risk assessment 
modeling chain. 

A review of existing models with the above considerations in mind 
led us to a choice between the widely used EPA Turner Model 1 and the H.E. 

Cramer model 2 . We selected the Turner Workbook approach. The basic Cramer model 

1 D. Bruce Turner, Workbook of Atmospheric Dispersion Estimates , EPA, 1970. 

2 R.K.. Dumbould and J.R. Bjorklund, NASA/MSFC Multilayer Diffusion Models 
and Computer Programs — Version 5 , H.E. Cramer Co., Inc., Salt Lake City, 

Utah, NASA CR-2631 , December, 1975. 
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is not significantly different from the Turner model in the sense that they 
are both Gaussian plume models. The, multi layer, version of Cramer's model 
referenced here offers a degree of refinement that appears to go beyond the 
requirements of, and the data availability for, the present study. To use 
the multilayer model, one must have the appropriate meteorological characteris- 
tics for the various atmospheric layers being modeled. Since we are postula- 
ting accidents we would require data for typical multilayer atmospheric 
structures at various airport-associated accident sites around the country. 

To determine typical multilayer atmospheric structures for each of a 
number of potential accident sites would require a significant meteorological 
investigation. The results would probably have to be given in terms of stan- 
dard synoptic situations or by season of the year. In view of their detailed 
input data requirements, and associated costs, it’ appeared wisest to reject 
relatively sophisticated approaches, as exemplified by the Cramer model; the 
same argument applies to primitive equation models which depend on the numeri- 
cal integration of the hydrodynamic equations of motion. Instead, a more 
readily applied model as exemplified by the Turner Workbook was selected. 

This model is also generally accepted by professionals in the pollution control 

field. 

EPA Standard (Turner) Model 

Turner's model (the present "standard" EPA model) provides for net 
downwind transport of material in the form of a plume that diffuses simultane- 
ously in the crosswind and vertical directions. The initial source can be 
elevated at a specified height. 

The atmosphere is characterized as being in one of several stability 
classes, with the most stable condition having the lowest mixing height 
(inversion level), and the least stable having the greatest mixing height. 
Dispersion parameters that govern the rate of crosswind and downwind diffusion 
are associated with each specified stability class. The dispersion parameter 
is smallest for the most stable atmospheric conditions and greatest for the 
most unstable condition. The magnitude of each dispersion parameter increases 
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with downwind distance from the source; the functional relationship for 
different stability categories is provided by the well-known Pasquill-Gifford 
dispersion curves. They are used in this ORI report in a form adapted from 
an EPA computer program called CRSTER 3 . These subjects are discussed in more 
detail below. 

The ORI Transport and Diffusion Model 

The plume rise calculations, performed separately, give the source 
height, which is then used explicitly in the transport and diffusion model. 
Plume rise calculations were discussed in Chapter IV. When the the inde- 
pendent plume rise calculations lead to plume heights greater than the 
height of the mixed layer, the plume rise is arbitrarily restricted to the 
layer height. In other words, heated plumes do not "punch through" the layer, 
as discussed in Section V. 

As described below, the ORI model has features not included in the 
standard Turner model. It provides for finite particle settling through use 
of a "tilted plume" model. Also, the model permits less-than-perfect reflec- 
tion of the diffusing cloud from the ground through introduction of a reflec- 
tion coefficient, as shown by Cramer. 


3 User's Manual for Single-Source (CRSTER) Model, EPA, July 1977, 

EPA-450/ 2-7 7-013. 


5-3 



GENERAL MATHEMATICAL MODEL 

The most general form of the ORI meteorological transport and 
diffusion equation is: 



where: 

D(x,y,z,H' ) = dosage at x,y,z (receptor location) in particle- 
sec m" 3 for the particle size of interest 

x = downwind distance from source to receptor, meters 
y = crosswind distance from source to receptor, meters 
z = elevation of receptor, meters 
u = mean wind speed, m sec" 1 , from release altitude to 
plume stabilization altitude, H. 

Q = total number of particles in the size range of 
interest released 

a = standard deviation of the wind speed in the crosswind 
direction, as a function of x and the stability class, 
in meters 

a z = standard deviation of the wind speed in the vertical, 
as a function of x and the stability class, in meters 
r = reflection coefficient, the fraction of particles 

that are reflected from the ground surface, dimension- 
less parameter 

Equation (5.1) makes use of the effective plume height, H'; this is the 
elevation of the plume central axis at any downwind distance, given by: 

H' = H - ( v s / u ) x (5.2) 
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where: 


H = elevation of plume at plume stabilization, meters 
v $ = particle settling speed, msec"\ for the selected 
particle size 

The ORI Equation (5.1) for dosage is essentially the same form 
as Turner's Equation (3.1) for concentration when the height, z, is set 
equal to zero. To show this precisely we note that there is no settling 
considered by Turner so that H'=H. Total reflection is assumed so that r 
in Equation (5.1) may be set equal to one. The two exponential terms in- 
volving a z represent diffusion away from the "true" source at H and an 
"image" source at -H. If we set 

r = 1 


we have the conditions for no gravitational settling of the diffusing parti- 
cles, perfect reflection of the particles at the ground surface, and have set 
the receptor for which the dosage is being estimated at ground level; these 
are the conditions assumed by Turner. Then, Equation (5.1) becomes: 


D(x,y,0,H) = 


va y°z u . 


exp 




(5.3) 


which is identical to Equation (5.10) presented in Turner's Workbook . 
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MODEL IMPLEMENTATION 


In this section we describe the actual methods used to adapt and 
modify Equations (5.1), (5.2), and (5.3) to capture the key elements of the 
problem at hand, as well as to make them amenable for computer application in 
a Monte-Carlo simulation. The major model adaptations are discussed in turn 
below, along with the development of the appropriate input data. It should 
be noted that the model programmed and used is somewhat more general than 
the one published by Turner. 

Elevated Virtual Source 

It is necessary to develop methods to provide a source of fibers 
some distance from the scene of the aircraft accident and fire that is 
liberating the fibers. Here "distance" is typically some vertical elevation 
of the fire plume, and some downwind distance at which the plume is said to 
be stabilized. At this point we may say that Equation (5.1) "takes over." 

It is customary in many applications of these diffusion methods to compute 
the plume size at stabilization, and then determine the location of an up- 
wind virtual point source from which a diffusing plume could be expected to 
grow, according to the diffusion model being used, to the actual size pre- 
viously computed for plume stabilization. In this case the virtual point 
source will certainly be upwind of the plume stabilization point, and either 
upwind or downwind from the accident site. In view of the large uncertain- 
ties present in many other phases of the complete risk calculation, and the 
insight that leads us to be concerned with effects some miles downwind from 
the accident site, we have chosen to arbitrarily set the virtual point source 
directly over the accident - fire site. The calculation of the plume 
height at stabilization has been discussed previously, and is, of course 
modeled in the full calculation. In this application, then, we approximate 
the actual elevated downwind finite source by a virtual point source directly 
over the accident site. 
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The Tilted Plume Model 


Ample experimental evidence exists to show that the graphite fibers 
we are interested in fall out with a non-neglible terminal velocity, variously 
estimated to be in the range of two to three centimeters per second. The diffusion 
and transport literature clearly indicates that fall rates of this magnitude 
have a significant impact on the downwind concentrations. These effects 
were also demonstrated in other calculations made for NASA Langley, princi- 
pally those by Trethewey and Cramer. In order to incorporate these effects 
into our calculations we have adopted the method presented by Van der Hoven . 

Van der Hoven proposed that the effect of gravitational settling of diffusing 
particles could be modeled by treating the plume as if it were tilted at an 
angle whose tangent is given by the ratio of the settling speed, v s> to the 
mean horizontal wind speed, u. The decrease in height of the plume center- 
line as the plume moves downwind is then given by (v $ /u)x, where x is the 
downwind distance from the virtual point source. The resulting centerline 
height H' would eventually reach a value of zero and then become negative as 
x increases. The model guards against this result by setting H' equal to 
zero for all values of x at which H' would otherwise have a negative value; 
this in effect prevents the tilted plume from "going underground." 

Dispersion Parameters 

Equation (5.1) requires input values of the dispersion parameters, 

Cy and a z , as functions of the downwind distance, x, and the prevailing 
stability conditions. The standard in this case is provided by the well- 
known Pasquill-Gifford curves, presented, for example, in Turner and shown 
here as Figures 5.1 and 5.2. Several investigators have recently questioned 
their universal applicability; the reader is referred to Pasquill's recent 

5 

work on this subject . In view of the fact that no generally accepted modi- 
fication of the Pasquill-Gifford curves yet exists, and that Cramer has 
indicated, in discussions held at NASA Langley, that simple modifications of 

4 Meteorology and Atomic Energy 1968 , David H. Slade, Editor, AEC, July 1968. 

(See section 5-3, "Deposition of Particles and Gases.") 

5 Pasquill, F. , Atmospheric Dispersion Parameters in Gaussian Plume Modeling, 

Part II, "Possible Requirements for Change in the Turner Workbook Values," 

EPA, Research Triangle Park, June 1976, EPA-600/4-76-0306. 
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°Z' METERS 



DISTANCE DOWNWIND, km 

FIGURE 5.1. VERTICAL DISPERSION COEFFICIENT, o,, AS A FUNCTION OF 
DOWNWIND DISTANCE FROM THE SOURCE 

(A = least stable, F = most stable) 

Source: Turner, 0£. cit. 
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DISTANCE DOWNWIND, km 


FIGURE 5,2. HORIZONTAL DISPERSION COEFFICIENT, ay, AS A FUNCTION OF 
DOWNWIND DISTANCE FROM THE SOURCE 

(A = least stable, F = most stable) 

Source: Turner, op. cit. 





these curves can handle most unusual meteorological-topographical situations, 
we have essentially adopted these curves for our calculations. The ORI risk 
assessment model uses a computational subroutine — SUBROUTINE. SIGMA — from 
the Single Source (CRSTER) Model developed by Turner and available from the 
EPA.. 6 

Mean Wi n d' Speed 

The mean wind speed to be used in Equation (5.1) is most conveniently 
related to the surface wind speed reported in standard meteorological data. 

The wind speed at any height, h, can be related to the surface wind speed, 
usually measured at an elevation of seven meters, by a power law: 

u = u 0 (h/7) p (5.4) 

where u Q is the surface wind speed in meters per second. 

The required mean wind speed must be representative of the layer in 
which the carbon fibers are dispersing. It is standard practice to use the 
wind Speed at the plume height for this purpose, on the grounds that the plume 
will disperse above and below that height. In this case Equation (5.4) may be 
written: 


u = u Q (H/7) p (5.5) 

If the actual plume height is lower than seven meters, it is set equal to 
seven. (In other words, u = u Q if H < 7.) For plume heights greater than seven 
meters, the value of u used in Equation (5.1) is then dependent on u ', H, and p. 
The exponent p depends, in turn, on the stability conditions. It is assigned 
specific values, for the different Pasqui 11 -Gifford stability classes, as shown 
in Table 5.1, adapted from EPA's CRSTER model. 6 


6 EPA, July 1977, 0 £_. cit . 
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TABLE 5.1 

VALUES OF WIND PROFILE EXPONENT 


Pasqui 11 -Gifford 
Stability Class 

■ 

Exponent, p 

A 

0.10 

B 

0.15 

C 

0.20 

D 

0.25 

E 

0.30 

F 

0.30 


Effect of Inversion 

The effect of an inversion lid (mixing height = H m ) above a neutral 
or unstable layer may be taken into account in two ways. First, at downwind 
distances where H' is greater than H m , it may be assumed that no particles 
will reach receptors (dosage equals zero) at the surface. Since the plume 
is tilted, H' decreases with increasing downwind distance, and where H' < H m 
dosage calculations can be made using Equation (5.1). In most cases, though, 
rather stringent physical conditions must be met for the plume to "punch 
through" the inversion. Observations indicate that this typically does not 
occur. It is therefore considered most reasonable to assume that if the 
computed plume height H is greater than the height of the inversion H m , it 
can be set equal to the inversion height. Indeed the ORI risk assessment 
model does this. 

Further, when the vertical range over which the plume is mixed 
becomes equal to the depth of the mixed layer (below the inversion), it can 
be assumed that this mixing results in a relatively uniform distribution of 
particles in the vertical. The model therefore, following Turner, makes the 
distribution of graphite fibers uniform in the vertical, from the ground 
surface to the base of the inversion, when o z becomes larger than 1.6 H m . 

For relatively low elevations of receptor points, it is reasonable to set z = 0 
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in Equation (5.1) to yield the following simplified equation for the dosage: 
0(x,y ,0,H' ) = 2^4 ex P [- I (^f j ex P j[^f ' (5 ‘ 5) 


Then, following Turner 7 , if mixing results In an essentially uniform 
distribution of the fibers in the vertical we can replace 


2 


(1+r) 


w y° z 



by 


(1+r) 

5.0133 a y H m 


(note that 2v/2tt = 5.0133) and obtain: 


D(x,y,0,H') 


Q(l+r) 

5.0133 o H u 
y m 



(5.6) 


Equation (5.6) is used in the model whenever o z >1.6 H m< 

Specification of Mixing Height Values 

The meteorological data is provided in the form of a frequency 
distribution of the combination of stability class, wind speed and 
direction; this data set does not include values of the mixing height. The 
actual value to be used in calculating downwind transport and diffusion of 
graphite fibers must be specific to the airport and meteorological conditions 
used in the particular Monte-Carlo run. 

g 

In our search for useful data we were led to a paper by Holzworth 
which gives mean (climatological) mixing heights for 62 National Weather 
Service stations in the contiguous United States. For example, Holzworth' s 
Table B-l gives the mean annual mixing .height for afternoons in Washington, 


7 Turner, o|3. cit . 

8 Georqe Holzworth, Mixing Heights, Wind Spee d s, and Potential for Urba n 
Air Pollution Throughout the Contiguous United States , EPA, January 1972. 


5-12 



D.C., as 1570 meters. (The corresponding value for Los Angeles -- Santa Monica 
is actually the site of the weather observations — is 814 meters.) These 
values are mean annual mixing heights, and we were still faced with the 
problem of generating values that were specifically associated with appro- 
priate wind direction, speed and stability class values. 

The problem of developing appropriate values of the mixing height 
for different stability conditions, given the mean annual mixing height, is 
addressed in a paper by K. L. Calder 9 . Calder, based on the analysis of 
available data and theoretical arguments, recommends that, for Pasquill- 
Gifford stability class A, the mixing height should be set equal to 1.5 times 
the Holzworth climatological value. For stability classes B, C, and D the 
mixing height is set equal to the Holzworth value. For stability classes E 
and F the mixing height is set equal to 100 meters. This method gives the 
results for Washington, D.C., and Los Angeles (Santa Monica), California, 
shown in Table 5.2 as examples. 


TABLE 5.2 

SAMPLE MIXING HEIGHTS FOR DIFFERENT STABILITY CONDITIONS 

(Meters) 


Stability 

Class 

Washington, D.C. 

Los Angeles 
(Santa Monica) 

A 

2355 

1221 

B 

1570 

814 

C 

1570 

814 

D 

1570 

814 

E 

100 

100 

F 

100 

100 

Climatological Mean 

1570 

814 


9 K. L. Calder, "A Climatological Model for Multiple Source Urban Air 
Pollution, Appendix D H to A, D. Buse and J. R. Zimmerman, User’s Guide 
for the Climatological Dispersion Model , EPA-73-024, December 1973. 
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Other Input Specifications 

In the description provided here of the ORI transport and diffusion 
model used in the overall risk assessment calculations, many of the necessary 
input parameters have been, perforce, defined. In this section we briefly 
note those input data sets that have not been explicitly covered above. 

• Wind speed and direction, with stability class, are available 
in a frequency distribution for all of the airports for which 
risk assessment calculations were made. This data base (the 
fundamental source is the STAR data provided by the National 
Climatic Center) is maintained by ORI as part of its work under 
a joint FAA-EPA aircraft engine emission study. For each of the 
four seasons, and the entire year, the data provide, for each 
Pasqui 11 -Gifford stability class, for each of the sixteen princi- 
pal wind directions, the frequency with which the surface wind 
speed was observed in any of five class intervals. In implementing 
the model we assumed the wind direction to be uniformly distributed 
within each of the 22.5-degree sectors centered about each of the 
sixteen principal wind directions, to avoid any systematic error 
due to geographical area center locations relative to the 
airport location. 

• Based on available data reported by several investigators, 
the value of the settling speed, v s » has been set equal to 
0.02 meters per second. 

• On the basis of our discussions with Trethewey and Cramer at 
the meeting arranged by the Project Officer at NASA Langley, 
we have used a reflection coefficient, r, equal to 0.7. This 
implies some reflection, but allows for some adherence of the 
fibers to surface roughness elements, which in the cases of 
particular interest are probably building sides, etc. 

The input value of Q, the mass of fiber released in the simulated accident is, 
of course, the principal input to the transport and diffusion calculation. 

Its development was discussed previously in Section IV. 
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VI. TRANSFER OF FIBERS INTO INTERIOR 
OF STRUCTURES 


This section of the report documents the development of the methods 
and inputs used to estimate the penetration of carbon fibers into representative 
buildings and structures. 

BASIC PROCESSES 

When a building or equipment enclosure is impinged on by a plume of 
carbon fibers, some of the fibers may enter the building or enclosure through 
air conditioning or other ventilation systems and by various air leakage paths. 
Once inside the building or enclosure, fibers will be removed by fallout and 
through leakage paths back to the outside. If inside air is recirculated and 
filtered, additional fibers will be removed by this method. The concentration 
of active fibers (e.g. those actually producing failure stresses on equipments 
in a building or enclosure) at any time may be determined from equations 
describing the net flow. These have been developed in a relatively simple 
form by Slade. 1 

The leakage and recirculation paths may be defined for typical build- 
ings and enclosures using standard design factors and ventilation rates 
contained in handbooks. Examples of these are the Handbook of Air Conditioning 


1 Slade, Tteteorology and Atomic Energy. Eq. (7.83), p. 365, 1968. 
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System Design 2 and the Standard Handbook of Mechanical Engineers . 3 Fallout of 
fibers may be estimated simply on the basis of known fiber fall rates and the 
area upon which fibers are being deposited. 

ORI MODELING APPROACH 

If a building or enclosure is impacted by a cloud of carbon fibers with 
an average concentration X, the rate of change of the amount of active fibers 
inside the building or enclosure is given by: 

dq = v.Xdt - v Q (|-)dt - v s a(|-)dt - v r (f) dt (6.1) 

where: 

q = number of active fibers in building or enclosure at time (t) 

1= average concentration of fibers outside building or enclosure 

at time (t) 

v. = rate at which fiber-borne air enters the building, or enclosure 
1 through both the air conditioning system and through all sources 

of leakage 

v = rate at which fiber-borne air leaves the building, including 

that removed by recirculation 

v = fall rate of carbon fibers 
s 

v = rate at which fibers are removed by recirculation filtering 
r 

s = volume of building or enclosure 
a = area of space subject to fallout. 

The above terms are defined in more detail as required during subsequent 
development in this section. 

Equation (6.1) may be rearranged into the following form: 



. 2 Carrier Air Conditioning Co., Handbook of Air Conditionin g System Design, 
McGraw-Hill Book Co., 1965. 

3 Standard Handbook for Mechanical Engineers , Baumeister & Marks, McGraw-Hill, 
196 T. 
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or: 


(6.3) 


dt _ 
s 



d(f) 

Vs* " v s a( s* " v r ( f } 


Now, for convenience, let 


A = v. + v.a + v 
os r 

so that Equation (6.3) can be more easily written as: 



v.X - A(|) 


(6.4) 


Equation (6.4) is most conveniently integrated for two special cases as 
shown in the next two subsections of this chapter. 

Inside Concentration During Build-up Phase 

The first special case to be considered is the build-up of the 
concentration of graphite fibers inside a building starting at the time the 
leading edge of the graphite fiber plume first hits the exterior of the 
building. For convenience let the time when this occurs be defined as 

t = 0 

at which time the interior concentration of fibers is also zero: 


In this case Equation (6.4) can be integrated to yield: 


t. 1 ln 
S' A ln 


In the more conventional 


i.'JL 

s A 


r_v__ 

[ v 1 X - A(q/s) 

exponential format this equation may be written: 

fl-e-W^l 


(6.5) 


( 6 . 6 ) 
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Interior Concentration During Decay 

The second special case to be considered for Equation (6.4) is that 
describing the behavior of the concentration of graphite fibers within an 
enclosure after the exterior plume has passed. If we define the time at which 
the cloud just passes the exterior of the structure as 

t = T 

then the exterior concentration at this time (and later times) is 
X = 0. 

The differential equation, Equation (6.4), takes the special form: 

dt _ _/l\ d(q/s) (6.4a) 

' T" Wwir 

which may be integrated to yield: 

\ 

kl = -(1/A)ln 
s 

This may also be written in the exponential form as: 

q(t) , q(T) Q -(A/s) (t-T) # (6.8) 

s s 

In this case we have made explicit the dependence of the fiber count, q, on 
time in order to differentiate between its value for time t from its value at 
the specific time of cloud passage, T. 

Calculation of Interior Exposure 

The exposure is defined mathematically as the integral of the 
concentration over time. For convenience we introduce a term E(0,T) for the 


g(t)/s 
lOT 


/s 


(6.7) 
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interior exposure at time T, and assume that the concentration was zero prior 
to time zero. The exposure at time T can then be written: 


E(0,T) 


•/ 


L v.X 


-(A/s)x 


dx 


(6.9) 


We lose very little generality with regard to the complete risk assessment 
calculation if we assume that the exterior concentration actually has the 
constant value X from time t = 0 until time t = T. This is particularly true 
because the transport and diffusion model , described in Section V of this 
report, actually treats the cloud of fibers in such a way that we may think 
of it as causing a sharp rise in exterior concentration to a constant level 
until the cloud passes, followed by a sudden drop to zero concentration. 

With this assumption it is a relatively straightforward matter to integrate 
the expression in Equation (6.9) to provide the following result: 


E(0,T) 



( 6 . 10 ) 


In analogous fashion it is possible to write an integral for the 
exposure due to the fibers interior to the structure after the exterior cloud 
has passed. We consider some time long after the exterior plume has passed, 
and consider this to be t = ® for our purposes. The exposure experienced after 
the exterior plume has passed is defined as E(T,») and is given by: 

oo 

E(T,®) = J e “( A /s) ( tt-T) dx (6.11) 

T 

which may be integrated to yield: 

E(T,«) = (s/A) (q/s) T . (6.12) 

The total interior exposure due to the passage of the exterior plume 
can be written as: 

E(0,®) = E(0,T) + E(T ,°°) . (6.13) 
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We evaluate this expression by using the results just obtained, namely 

Equations (6.lti) and (6.12): 


E(0 




(e' (A/s)T - 1) 



(6.14) 


Now we note that Equation (6.6) can be written, for time T, as 


s A 



e -(A/s)T ; 


(6.6a) 


This can now be substituted into Equation (6.14), after which, if terms are 
appropriately combined, we obtain: 


v f 

E(0,«) = X T ' 


(6.15) 


The exterior exposure, due to our assumption that the concentration 
is a constant value X over a time period of length T, is simply given by: 

E 0 = XT 

so that the interior and exterior exposures are related by: 


E 0 A v 0 + av s + v r 

which may be termed the "penetration factor.' 

Penetration Factors 

Equation (6.16) forms the principal basis for our calculation of 
interior exposure values which are used, in turn, to compute the failure 
probabilities for specific equipments, as described in Section VII, which 
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follows. Each of the terms appearing in that equation is discussed in 
more detail below: 

• The rate at which fiber-borne air, v^, enters the building or 
other enclosure includes that which enters through the air 
conditioning system and that which enters via leakage. The 

'air entering through the air conditioning system is obtained 
from the air conditioning airflow, v . and the filter ef- 
ficiency, EFF, as follows: 

v acf = v ac (1 - EFF >- (6-17) 

t The rate at which fiber- borne air enters the building or other 
enclosure via leakage, Vp is obtained from standard air con- 
ditioning planning factors for various combinations of types 
of doors and windows, in different types of buildings, lo- 
cated in different climatic zones, for different wind con- 
ditions. Then: 

v i " v acf + V 1 • (6.18) 

• The rate at which fiber-borne air leaves the building, v Q , as- 
suming conservation of mass, is equal to the total of the air 
entering the building through the air conditioning or ventilat- 
ing system and the air entering the building via leakage: 

v o = v ac + V 1 • (6.19) 

• For the fall rate, v , we have used the nominal value of 4 

s 

feet per minute, or 2 centimeters per second for all calcula- 
tions; this appears to be in accord with current observational 
data. 

• The rate at which fibers are removed by recirculation, v r , ac- 
counts for fibers removed by recirculation filters plus that 
which deposits in the ductwork. The rate at which fibers are 
removed in the recirculation system is obtained from the pro- 
duct of the recirculation rate, v rr , and the filter effi- 
ciency, while that which is deposited out is estimated by the 
product of the fall rate, v $ , and the effective area of the 
recirculation system, a r : 

v r = v rr (EFF) + v s a f . (6.20) 
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Multiple Enclosures 


In some instances there can be several enclosures in series in the 
penetration path, for example an equipment housing may be located inside of 
a building. In this case, the penetration factors are multiplied together 
to arrive at an effective overall factor. This operation tacitly assumes that 
the result derived in Equation (6.16) holds even if the exterior concentration 
cannot be characterized as a square wave. Intuitively, this assumption appears 
reasonable in the present context. 

CHARACTERIZATION OF TYPICAL STRUCTURES 

The sizes, shapes, and types of buildings and equipment enclosures 
of interest to this study are, of course, nearly infinite in variety. How- 
ever, if it is assumed that these buildings and enclosures have been designed 
to generally accept heating and ventilation standards, they can be defined 
by a few rather standard categories. It is assumed that all buildings and 
equipment enclosures can be adequately defined by one or more of the following 
categories: 

1. Small Equipment Building or Van 

2. Medium Equipment Building 

3. Large Equipment Building or Factory 

4. Equipment Room inside a building 

5 . Uti 1 i ty Room 

a) filtered 

b) unfiltered 

6. Hospital Operating Room, Intensive Care Area 

7. Switchgear Cabinet 

a) filtered 

b) unfiltered 

8. Electronic Equipment Enclosure - forced air 

a) filtered 

b) unfiltered 

9. Electronic Equipment Enclosure with louvers 

a) filtered 

b) unfiltered 

10. Residence 

a) air conditioned 

b) not air conditioned 

11. Business/Office Building. 
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Design Factors 

Table 6.1 shows the design factors associated with each category of 
building or enclosure defined above. These design factors are used to deter- 
mine the air conditioning flow rates, filter efficiencies, and air leakage 
rates used in Equation (6.16) et seq. The sizes of buildings and enclosures 
have been arbitrarily selected. It should be noted that enclosure size is 
not critical as long as the associated ventilation rate is reasonable for 
that size enclosure. 

The types and numbers of doors and windows were selected on the basis 
of building type and size. It is assumed that the addition of doors and win- 
dows for larger buildings of the same type would result in approximately con- 
stant leakage per volume (i.e., leakage effects are independent of building 
size once a basic design is selected). The size and type of doors and windows 
are selected from those shown in Table 44, pp. 1-95 of the Handbook of Air 
Conditioning System Design . 4 Industrial doors are well fitted metal doors 
with weatherstripping. Hospital doors and business doors are selected from 
Table 41 E, pp. 1-91. The leakage rate through business doors is based on 
an average occupancy rate of 5 people per 2400 square feet and 2.5 CFM 
leakage per person. 

The ventilation rates shown in Table 6.1 are based on standards 
contained in the Handbook of Air Conditioning System Design 5 and in the 
Standard Handbook for Mechanical Engineers . 6 Ventilation rates for electronic 
equipment, in cubic feet per minute, are approximated by: 

ventilation rate = power consumption in watts/required 

temperature reduction in degrees F. 

Typical electrical and electronic equipment must be kept within about 20 
degrees Fahrenheit of the ambient temperature so that a ventilation rate of 
approximately 1.5 cubic feet per minute (CFM) per watt consumed is a reasonable 
value to assume. 

4 Op. cit. 

5 Ibid. 

6 Op. cit. 
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TABLE 6.1 

DESIGN FACTORS FOR TYPICAL ENCLOSURES 


Enclosure 

Category 

Size 

W x L x H 
(feet) 

Doors Facing Wind 

Windows Facing Wind 

Ventila- 

tion 

Rate(CFM) 

Filter' 

iff,* 

No. 

Size 

Type: 

No. 

Size 

Type 

1. Small Equipment 
Building or Van 

15 x 30 x 15 

1 

3' x 7 1 

Industrial/ 

Weatherstrip 

0 



300 

852 AFI 
952 CF 

2. Medium Equipment 
Building 

30 x 60 x 10 

2 

3' x 7* 

Industrial/ 

Weatherstrip 

2 

3' x 5' 

Industrial 
Casement 
1/64" Crack 

1000 

852 AFI 
952 CF 

3. Large Equipment 
Building or Factory 
Building (per floor) 

100 x 300 x 10‘ 

3 

3' x 7' 

Industrial/ 

Weatherstrip 

20 

3' x 5* 

Industrial 
Casement 
1/64" Crack 

3000 

802 AFI 
902 CF 

4. Equipment Room In 
Building (one exter- 
ior wall ) 

30 x 60 x 10 

2 

' 

3‘. x V 
Interior/ 
Exterior 
Vestibule 

Factory Type 
Interior and 
Exterior 

5 

' 

3' x 5 ' 

Industrial 
Casement 
1/64" Crack 

1000 

852 AFI 

902 CF 

5. Utility Room 

30 x 60 x 10 

1 

3‘ x /' 

Factory Type 
Exterior/ 
1/6*' Crack 

0 



500 

a - 852 AFI 
952 CF 
b - None 

6. Hospital Operating 
Room, Intensive 
Care Area 

20 x 25 x 10 

i 

2 

3‘ x 7* 
with Ves- 
tibule 

Swinging 

Door 

0 

“ “ 


1000 

i ' : 

Dcuble at 
952 CF Each 

7. Switchgear Cabinet 
(From Westinghouse 
Catalog 55-000) 

5x3x7 

0 

i 

- - 

' 

0 

B 

Bj 

Bj 

warn 

8. Electronic Equipment 
Enclosure (with 
forced air) 

2 x 1 x 1/2 

■ 

- - . 

; 

' 

0 


- - 

30 

(20 

watts) 

a - 852 AFI 
552 CF 
b - None 

9. Electronic Equipment 
Enclosure (with 
louvers) 

2x1x1 

0 



0 


— 

— 

3 

(2 watts) 

ffnragttjjMI 

■ralallH 

Hi 

10. Residences 

40 x 30 x 8 

■ 

3' x V 

Glass - Avg. 
Fit 3/16" 
Crack 

4 

4' x 7' 

Residential 
Casement 
1/32' Crack 

a - 3TTC 
b - None 

tsofosttf 

11. Business (Small) 

60 x 40 x 10 

■ 

Q 

Swinging 

All Windows Sealed 


332 AFI 
952 CF 


* Two types considered: Dry Type Glass Wool: 852 AFI, 952 CF 

Viscous Impingement: 802 AFI, 902 CF 


* 




















The effectiveness of filters with respect to carbon fibers of various 
size is not accurately known. Comparisons of American Filter Institute values 
for standard filter types with available graphite fiber tests on similar filters 
indicate the approximate relations shown in Table 6.2. 


TABLE 6.2 

COMPARISON OF REPORTED FILTER EFFECTIVENESS 
WITH EFFECTIVENESS IN FILTERING GRAPHITE FIBERS 

(percent) 


Effectiveness 

Graphite Fiber 

Reported by AFI 

Effectiveness 

80 

90 

85 

95 

95 

99 

99 

99.9 


Penetration Parameter Values 

Table 6.3 summarizes the data obtained from the several sources 
referenced above for the different enclosure types defined here. These are 
shown for buildings in typical temperate zone climatic regimes for different 
values of the wind speed. In implementing these values for the computer model 
it was determined that the "fallout term" tended to dominate in computing 
numerical values of the ratio shown in Equation (6.16). The values were 
therefore relatively independent of wind speed. For this reason a standard 
10 mile- per- hour wind speed was assumed to be blowing directly at external 
windward doors and windows. In addition, the following assumptions were 
introduced: 

i 

• The "air conditioning" for enclosure types 7b, 9a, 9b is by 
natural convection through louvers at recommended values. 

• Leakage of air into electrical and electronic enclosures 

(other than that which is intended through louvers) is neglected. 
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TABLE 6.3 


VENTILATION RATES (CFM) FOR TYPICAL ENCLOSURES 
AT VARIOUS WIND SPEEDS 


BB 

0 mph* 

5 mph 

10 mph 

15 mph 

E 

O 

CNJ 

Dh 

v i 

V o 

V i 

B 

v i 

v o 

v i 

V 0 

v i 

D 

i 

15 

300 

24 

309 

25 

310 

33 

318 

41 

326 

2 

50 

1000 

69.6 

1020 

80 

1030 

95.6 

1046 

115.8 

1066 

3 

300 

3000 

343 j 

3043 

390 

3090 

450 

3150 

516 

3216 

4 

50 

1000 

61 

1011 

73 

1023 

88 

1038 

104 

1054 

5a 

25 

500 

89 

564 

153 

628 

217 

692 

285 

760 

5b 

500 

500 

564 

564 

628 

628 

692 

692 

760 

760 

6 

2.50 

1000 

4.25 

1002 

6.00 

1000 

7.70 

1005 

9.43 

1007 

7a 

15 

300 


Infiltration thru cabinet neglected 


7b 

1 

1 


Switchgear assumed inside building 


8a 

1.50 

30 



Leakage is assumed to be zero 


8b 

30 

30 



Leakage is assumed to be zero 


9a 

0.15 

3 



Leakage is assumed to be zero 


9b 

3 

3 



Leakage is assumed to be zero 


10a 

15 

300 

131 

416 

262 

550 

372 

657 

■ 

527 

812 

10b 

0 

0 

416 

416 

550 

550 

657 

657 

812 

812 

11 

25 

500 

30 

505 

37.5 

512.5 

45 

520 

55 

530 


*These values also apply to pressurized enclosures. 
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With these additional minor assumptions, the input parameters for 
calculating the transfer function, or effect of ventilation on allowing ex- 
terior fibers to enter buildings or other structures, are those shown in 
Table 6.4. The relationship of these building and other enclosure types to 
different facilities modeled in each of the airport-urban complexes 
treated in the risk assessment calculations is established in the next 
section of this report. There it is shown that each class of business 
or industry may be characterized as being located in one or more of the 
types of enclosures described in this section. The use of these one-to-one 
relationships between business type and building type reduces the input 
data variability and thus tends to reduce the variance of the final re- 
sults. On the basis of resources available for this analysis, and the ex- 
pected difficulty in improving on this assumption, it was considered most 
appropriate to make this assumption and accept the consequences. The 
calculation of the failure probabilities for specific equipment in parti- 
cular classes of enclosures is combined with the calculation of the trans- 
fer of fibers from the outside to the inside of those enclosures. 
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TABLE 6.4 


INPUT PENETRATION PARAMETER VALUES FOR SELECTED BUILDING AND ENCLOSURE TYPES * 


n...i l J .* M «i 

Penetration Factors 

Building ■ 
or 

Enclosure 

Type 

v ac 

(i-eff) 

v acf 

V 1 

V 

v o 

aV s 

v +av_, , 
a s 

> o 

1 

300 

.05 

15 

10 

25 

310 

1800 

2110 

.01180 

2 

1000 

.05 

50 

30 

80 

1030 

6000 

7020 

.00989 

3 

300 

.10 

300 

90 

390 

3090 

100,000 

103090 

.00378 

4 

1000 

.05 

50 

23 

73 

1023 

6000 

7023 

.01040 

5a 

500 

.05 

25 

128 

153 

628 

6000 

6628 

.02310 

5b 

500 

1.00 

500 

128 

628 

628 

6000 

6692 

.09380 

6 

1000 

.0025 

2.50 

3.50 

6.0 

1000 

6000 

7000 

.00086 

7a 

300 

.05 

15 

0 

15 

300 

60 

360 

.04170 

7b 

1 

1.00 

1 

0 

1 

1 

60 

61 

.01640 

8a 

30 

.05 

1.50 

0 

1.50 

30 

4 

34 

.04410 

8b 

30 

1.00 

30 

0 

30 

30 

4 

34 

.88200 

9a 

3 

.05 

0.15 

0 

0.15 

3 

4 

7 

.02140 

9b 

3 

1.00 

3 

0 

3 

3 

4 

7 

.42800 

10a 

300 

.05 

15 

247 

262 

550 

4000 

4550 

.05800 

10b 

0 

1.00 

0 

530 

550 

550 

4000 

4500 

.11100 

11 

500 

.05 

25 

12.5 

37.5 

512.5 

9600 

10112.5 

.00370 


*A11 ventilation rates are in cubic feet per minute. 




VII. FAILURE OF INDIVIDUAL AND COLLECTIVE EQUIPMENTS 


DESCRIPTION OF FAILURE MODELS 
Use of Exponential Model 

The probability of failure of equipment which is exposed to carbon 
fibers is obtained from the exponential expression: 

P F = 1 - exp [-E/E ] C 7 .* 1 ) 

Where: 

Pp = probability of failure of equipment 

E = exposure level in the immediate vicinity of the 

vulnerable equipment, in fiber-seconds per cubic meter 

F = average exposure level causing a failure 

The U.S. Army Ballistics Research Laboratory (BRL) at Aberdeen, Maryland has 
tested the exponential model against a large number of test results and has 
shown that the experimental data show a close fit to the exponential 
failure law. 1 ’ 2 ORI also completed a log-linear plot of e" ct as a function of 
time- to-fai lure (t) for various concentrations (c). This analysis, performed 
during ORI's previous Phase I work using data from the Ford Aeronautics 

1 Have Name Vulnerability of the Improved Hawk System . BRL Report No. 1964, 
Shelton & Moore, Feb. 197.7. 

ORI discussions with BRL, Aug. 15, 1978. 

7-1 


2 



generic target tests showed a linear relationship except for large values of 
the time-to-failure, for which data were sparse. For our purposes, then, 
Equation (7.1) is considered to adequately describe the probability of failure 
for a single piece of equipment as a function of exposure. 

Incorporation of Penetration 

The values of exposure used in Equation (7.1) are those directly 
impinging on the vulnerable equipment. When this equipment is located within 
a building and/or enclosure, the value of the internal exposure may be obtained 
from the outside exposure by multiplying the external exposure by the appropri- 
ate penetration factor(s) (as described in Section VI): 

E = E 0 KP ( 7 - 2 ) 

where: 

E = inside exposure 
E 0 = outside exposure 

v i /x 

KP = — — +~v~ * P ene t rat i on factor (Sec. VI). 
v o s r 

When an equipment is doubly enclosed, for example, when equipment is 
in a cabinet that is inside a building, an overall penetration value is 
obtained from: 

KPi = (KP b ) • (KP e ) (7-3) 

Where: 

KP.j = overall penetration factor for equipment (i) 

KP b = penetration factor for building 
KP e = penetration factor for enclosure 

Development of Failure Constants 

Since the penetration factors and the mean exposure to failure, E, 
are constants for any particular piece of equipment in a particular enclosure 
(where enclosure describes the building type as well as any box the equipment 
is in) we can define a single failure parameter: 



Where: 


K_ = overall failure parameter for equipment of type i 
in an enclosure of type j 

KP. = penetration factor for an enclosure of type j 
3 

E.j = mean exposure to failure for equipment of type i 

The parameter K-jj may now be substituted into Equation (7.1) to yield a use- 
ful relationship giving the probability of failure for equipment of type i 
in an enclosure of type j for any value of the exposure recorded exterior 
to the enclosure: 


P 


F,i j 


1 - exp (-Kjj 



(7.5) 


Treatment of Equipment Configurations 


The failure probabilities for individual equipments may now be 
combined to cover various series, parallel, or series-parallel configurations 
found in typical facilities. It is first convenient to define the reliability 
of a particular piece of equipment in a particular class of enclosure as: 



F.ij 


Then we can write, for several pieces of equipment in series: 


(7.6) 


P FS,j " 1 ' R lj R 2j 

= 1 -(e" K lj E 0)( e ' K 2j E o) . . . . 

= i - e " (K l3 + K 2j + • • • * ) E o 

This is the probability that at least one of the equipments in series fails. 
For situations in which several equipments are in parallel (redundant configu 
rations), the probability of failure for the aggregate is given by: 


Pen ■: = Pc i • * Pr- o • 

FP »J F ,1 J F ,2j 


(7.7) 


Series-parallel equipment configurations are treated by first converting 
parallel combinations into an aggregate equivalent and then computing 
failures for the resulting series configurations. 
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A standard configuration from which all facilities may be synthesized 
is shown in Figure 7.1. "PRI" represents the primary source of power from the 
public utility. When this source fails, power at the facility must be obtained 
from a local auxiliary power supply, "AUX," if such a supply is available. 

Box "SW" refers to service switchgear which handles incoming power at the facil 
ity. Common equipment includes central computers, central communications, etc. 
The failure of common equipment results in an overall failure of the facility. 
Distributed components account for parallel assembly lines or other parallel 
production elements so that the failure of a distributed module would reduce 
facility capacity or production without causing a complete facility outage. 


from: 


where : 


The probability of no input power at the facility (Pnr) is obtained 



(1 - P pRI ) ' (P $w ) 



= probability of failure of primary power 
= probability of failure of switchgear 


(7.8) 


The probability of no power Inside the facility (P^pj) is given by: 


P NPI ' P NP ' P AUX 


(7.9) 


where P^ x is the probability that the auxiliary power system fails. The 
probability that there is power inside the facility is equal to: 


PI 


= 1 - P 


NPI 


The probability that there is power inside the facility but that the facility 
is down due to a failure of the common module is equal to: 

P PI * P FC 

where Pp C is the probability of failure of the common module. 

Similarly, the probability that there is power inside the facility 
and that “the common module has not failed, but that the facility's production 
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FIGURE 7.1. STANDARD CONFIGURATION 
FOR MODELLING FACILITY POWER FLOW 
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or output is reduced due to a failure of one of the distributed modules is 
estimated by: 

P PI ^ “ P FC^ P FD 

where Ppp is the probability of failure of one distributed module: for example, 
one of several production lines operating in parallel. 

By carefully summing up the terms of the relationships developed 
above, we find that the probability of no output or production from any single 
distributed module is equal to: 

F = P NPI + P PI P FC + P PI ^ ‘ P FC^ P FD ^ 7,1 °^ 

Now, the probability that exactly n out of a total of N distributed 
modules remain in production— do not fail --is given by: 

«■>.") * (8) O - PfD>" < P FD )N '" . 

In this case the fractional capacity associated with the n distributed modules 
that do not fail is n/N. We may therefore write, for the expected capacity 
or production obtainable from the distributed modules: 

| o (ft) (») 0 - p F0 )" cw N -" 

‘ (ff) N (1 - P FD> * 1 ' P FD 

The fraction of production lost due to failures of the distributed modules may 
therefore be estimated by Pp D , the probability of failure of one distributed 
module, and Equation (7.10) can be used to estimate the fraction of production 
or output lost due to failures at the facility. If the equation were applied 
to many identical facilities we would expect the overall result to be essentially 
the same as if each facility's degradation were obtained by a random sampling 
procedure. In actual analyses, however, the equation is applied to a variety of 
facil ity- types at one location, and this may result in some reduction of variance 
in the final results. 
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RELATIONSHIP OF INDUSTRIES AND POPULATION CENTERS TO EQUIPMENT ENSEMBLES 
Methodology 

In any center of population, i.e., urban area, close to a major air- 
port, there is a wide range of facilities measured by type and/or size. There 
is also great variability in types and configurations of equipment across 
facilities, or even within facilities of a particular type. The only approach 
considered practical for this study was to define "typical" facilities which are 
believed to best represent specific facilities in existence in the geographical 
area being studied during the time frame of interest. Failure computations 
were then addressed to these typical facilities. To provide the basis for 
defining the typical facilities it was decided to make use of a classification 
scheme already well established for other, quite different reasons: the U.S. 

Census Bureau Standard Industrial Classification (SIC) Codes. It is recog- 
nized that in some cases there can be a bigger difference between two facilities 
characterized by the same SIC Code than between facilities with different code 
numbers. However, these code numbers do provide a standardized basis for 
facility definition and have the advantage of being directly relatable to popu- 
lation centers for which census data are readily available. Further, as shall 
become evident below, in Section VIII of this Report, this decision makes a 
great body of data developed for economic analysis available for use in 
estimating the dollar impact of a graphite fiber incident. A partial list of 
SIC numbers and corresponding business types is shown in Table 7.1. The industry 
categories shown are those that figured prominently in the study. 

The types of individual equipments and their groupings into typical 
facility configurations (of the type typified generally by Figure 7.1) were 
prepared after a broad literature review, supported by a number of site visits, 
and further augmented by discussions with representatives of several major 
industries and government agencies. These data and information-gathering 
activities are summarized here. Documents covered in the literature review, 
primarily periodicals in order to obtain up-to-date information, included: 

• IEEE Spectrum 1970 to Present 

• Instruments and Control Systems 1970 to Present 

• Production Engineering (formerly Automation ) 1970 to Present 

• Computers and Automation 1975 to Present 
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TABLE 7.1 

SELECTED LIST OF SIC CODE NUMBERS 


Major Industry Group 

Manufacturing 

Food and kindred products 
Textile Mill Products 
Apparel and other textile products 
Lumber and wood products 
Furniture and fixtures 
Printing and publishing 
Chemicals and allied products 
Petroleum and coal products 
Rubber and mi sc. plastics products 
Primary metal industries 
Fabricated metal products 
Machinery, except electrical 
Electric and electronic equipment 
Transportation equipment 
Instruments and related products 

Transportation and other ptblic utilities 

Transportation by air 
Communication 

Electric, gas, and sanitary services 

Wholesale trade 

Wholesale trade-durable goods 
Wholesale trade-nondurable goods 

Retail trade 

Building materials and garden supplies 
General merchandise stores 
Food stores 

Automotive dealers and service stations 
Apparel and accessory stores 
Furniture and home furnishings stores 
Eating and drinking places 
Miscellaneous retail 

Finance, insurance, and real estate 

Banking 

Credit agencies other than banks 
Security, commodity brokers and services 
Insurance carriers 

Services 

Business services 
Health services 
Government 

M)efi ned by ORI ~~~ ^ 
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• Data Processing 1975 to Present 

• Electronic Communication 1975 to Present 

• Machine Design 1975 to Present 

Visits were made to the following facilities in the Washington, D.C. metro- 
politan area: 

• Washington National Airport 

• Holy Cross Hospital, Silver Spring, Md. 

• Montgomery General Hospital, Olney, Md. 

• Radio Station WTOP, Wheaton, Md. 

Discussions were held with representatives of the following specific industri 
and government agencies: 

• Potomac Electric Power Company 

• Edison Electric Company 

• IEEE Substation Design Group 

• Department of Energy/Energy Research and Development Agency 

• Federal Power Commission 

• Westinghouse Substation Design Group 

• Department of Health, Education, and Welfare/ 

Bureau of Medical Devices 

• General Electric Medical Devices Division 

In addition, several visits were made to the Ballistics Research Laboratory 
(BRL) , Aberdeen, Maryland, for general discussions on the subject of equip- 
ment vulnerability, the review of test procedures used at that facility, and 
the review of specific exposure-to-failure results. 

The equipment types finally defined for each SIC code-typical 
facility were then compared with the types of equipment that had been covered 
in the BRL test program. Mean exposure-to-failure values were selected for 
those equipments tested that most closely matched the equipments defined for 
each typical industrial -commercial facility, as well as residences. Once the 
task of defining the typical facility for each required SIC code number was 
completed, the numbers of each facility-- business or industrial unit --in 
each county or other geographical area of interest were obtained directly 
from published Bureau of Census data, primarily the County Business Patterns . 



These data were necessarily supplemented in some cases by personal contacts 
with Census Bureau personnel. The methods used to assess the consequences of 
industrial-commercial failures and their associated costs are described in 
Section VIII of this report. 

Description of Typical Facilities 

Specific types of industries and related facilities are described 
in Appendix A. Appendix A serves as a baseline from which configurations and 
vulnerability factors for each required SIC Code were derived; the appendix 
contains the following information: 


• Descriptions of specific configurations 

• Description of equipment components 

• Rationale for assigning enclosure types 

• Rationale for assigning mean exposure-to-failure values. 
Standardized configurations for the various SIC Codes, based on varia- 
tions of Figure 7.1, are described below and illustrated in Figure 7.2: 






Flectric Utility ; SIC 49; Figure 7.2a. The station consists 
of common conmuni cations and controls together with a number of 
parallel bays, each consisting of a switchgear panel and high 
voltage equipment. 

Small Light Industry ; SIC 20,23,24,27,38; Figure 7.2b. These 
industrial plants are assumed to have no auxiliary power. The 
following specific changes were made to the general configuration 
shown in Figure 7.2b for each of the SIC numbers shown: 


- SIC 23,38: 

- SIC 20,38: 

- SIC 24 : 

- SIC 23,27: 

- SIC 24 : 


replace service switch with power distribution 
servo circuits as shown 

replace interface unit + servo with high voltage 
motor controls and heavy duty motors 

power directly from controller to small motors 

no controller 


• Urge Light Industry : SIC 22,25,34,35,36; Figure 7.2c. 

Large light industries are similar to small light industries 
except that auxiliary power is assumed to be available. The 
following variations of Figure 7.2c were introduced: 
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(a) Electric Utility, SIC 49 


Inside Substation _ 

Building 0uU,de 



(b) Small Light Industries. SIC 20. 23. 24, 27, 38. J 



(c) Large Light Industries. SIC 22, 25, 34, 35. 36. T 



(d) Heavily Automated Industries. SIC 26. 28. 29. 30. 33,37. f 



(t) Business Service. SIC 60,61,62,63,73. | 



FIGURE 7.2. CONFIGURATION OF EQUIPMENT FOR SPECIFIC INDUSTRY GROUPS IDENTIFIED 

BY SIC NUMBER 
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jf? Health Services ♦ SIC 80 | 



(g) Air Transportation - SIC 45 (Air Traffic Control System]"!' 



(h) Communication Services (Telephone) SIC 48 



(i) Small Business Establishments - SIC 50 thru 59. 99. 



FIGURE 7.2. (CONCLUDED) CONFIGURATION OF EQUIPMENT FOR SPECIFIC INDUSTRY 

GROUPS IDENTIFIED BY SIC NUMBER 
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SIC 22,36: interface units and servos as shown 

— SIC 25,34,35: replace interference units and servos 

with high voltage controls and motors 

SIC 34,35,36: line controller 

SIC 25 no line controller 

• Heavily Automated Industry : SIC 26,28,29,30,33,37; Figure 7. 2d. 

Heavily automated industries are similar to large light indus- 
tries except that they have a common module consisting of compu- 
ters in parallel, together with keyboard/displays which are also 
in parallel. SIC 28,29,30 and 37 are assumed to have production 
lines dominated by servo systems while SIC 26 and 33 are assumed 
to have production lines dominated by high voltage motor controls 
(switchgear) and heavy duty motors. 

t Business Services : SIC 60,61,62,63,73; Figure 7.2e. 

Business service facilities are assumed to have a single central 
computer with associated power converter and keyboard/display. 
Distributed modules consist of data terminals (keyboard/display) 
together with local processors and input-output interface units. 

• Health Services : SIC 80; Figure 7.2f. 

Health service facilities are assumed to be vulnerable only to 
power outages, and to possess auxiliary power. It is assumed 
that medical devices and other vulnerable "production" units are 
in highly protected environments. 

• Air Transportation : SIC 45; Figure 7.2g. 

Air traffic control consists of power units together with central 
computing facilities. The distributed modules actually consist 
of RADARS, ILS, VORs, Communications, etc. These are highly 
redundant, well filtered, and have local (site) auxiliary power, 
and on this basis were not included in the computerized model. 
Off-line calculations showed that the risk to such facilities 
could be neglected. 

• Communication Services (Telephone): SIC 48; Figure 7. 2h. 

A very simplified telephone central office is assumed to consist 
of one common marker and register equipment serving a number of 
trunk frames and line frames via relay switches. 
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• Small Businesses ; SIC 50-59,99; Figure 7.2i. 

Small business establishments are assumed to be vulnerable only 
from the standpoint of power outage. The only vulnerable equip- 
ment within the establishment are power distribution circuits. 

t Private Residences 

Residences with and without air conditioning are considered, 
using a fraction of occurrence based on type of county (urban, 
rural). The only equipments considered to be vulnerable were 
television sets and high-fidelity equipment. Electric toasters 
are vulnerable but, because of their relatively low replacement 
cost, they were not included in the calculation. On the other 
hand, toasters do appear to constitute a potential shock hazard; 
this effect was not included in the calculations reported here. 

The considerable uncertainty surrounding this problem made it 
virtually impossible to attempt to quantify the phenomenon. It 
is a subject that clearly requires more attention in further 
analysis of the carbon fiber risk. 

Implementation for the Simulation Model 

The computer program that determines the impact of each simulated 
aircraft accident and associated release of graphite fibers uses Equation (7.10) 
to estimate the probability that each business or industry in the geographical 
area of interest is affected. One of the major efforts in this project has been 
the characterization of each business-industry sector, defined by an SIC number, 
by a specific set of equipments installed in a specific type of structure. The 
results for the physical plant were described earlier, and the equipment problem 
has been covered in this section. Once these definitions have been arrived at, 
we have, in effect, defined a set of K^- (cf Equation (7.4)) for each class of 
equipment in each class of building. 

Failure parameters were prepared for each SIC number by using expressions 
(7.3) and (7.4) for each equipment-enclosure combination defined for each rele- 
vant SIC number. In terms of the configurations illustrated in Figure 7;2, the 
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following generalized equipment categories were defined: 

• service switch, or power distribution panel 

• auxiliary power system 

• common equipment module 

§ distributed equipment module. 

It was found that, for computer input specification, it was useful to define 
a set of input parameters less abstract than those relying on the "ij" notation. 
Accordingly, the following set of failure parameters were defined; these cor- 
respond to the K-jj defined by Equation (7.4), and are prepared for each SIC 
number needed for each airport-urban area simulated: 

• K f cu Input failure parameter for service switch, input power 

F,bW panel, or transformer 

• k F AUX Input fai1ure P arameter for auxiliary power system 

• K c r Input failure parameter for common equipment module 

F 

• Kp Input failure parameter for distributed equipment module. 

In order to accommodate the wide variety of actual configurations 
shown in Figure 7.2 and described above within the general structure of power 
flowing into a generalized interface (transformer and/or switch panel), an 
auxiliary power system in parallel to a common module, and then to a parallel 
set of distributed modules, several strategies were adopted, as listed below: 

• If no auxiliary power system is available, the auxiliary power 
system is treated as "always failed" by assigning an essentially 
infinite failure parameter 

• If the facility being modelled has no service power interface 
Kp ^ is set equal to zero; i.e., it can never fail 

• If the facility has no common equipment, Kp^ c is set equal to 
zero; it can never fail 

§ If the facility has no distributed modules, Kp^ is set equal 
to zero; they can never fail 

• If the facility has several equipments in parallel, to insure 

a high degree of redundancy, collectively these are assumed not 
to fail; the failure parameter for this stage is set equal to 
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zero. When tested with model -generated values of the exterior 
exposure and other input parameters, this approximation was 
of the same order as those tolerated elsewhere in the analysis. 

SUMMARY OF FAILURE PARAMETERS 

The tables which follow summarize the equipment and equipment module 
failure parameters, and enclosure characteristics. These are based on the 
facility and equipment designations contained in Appendix A and the methods 
described in this section. 

Mean Exposure- to-Failure Levels 

Failure exposure levels for individual equipments at each type of 
facility are shown in Table 7.2. These equipments are those shown previously 
in Figures 7.2. Note that the primary power referred to under each facility 
is the power source represented by the public utility (SIC 49). Note that 
electric motors are assumed to not be vulnerable (based on limited test data). 
Facility Equipment Enclosures 

Table 7.3 shows the enclosure categories associated with each SIC 
Code for the equipments shown in Figure 7.2. When an enclosure is located 
inside a building (double enclosure), the building category is listed under 
level 1 and the equipment enclosure category is listed under level 2. Enclo- 
sure categories were defined in Section VI. Note that Table 7.3 reflects 
many of the SIC special cases within the broad industry categories 
discussed previously. 

Facility Failure Parameters 

The facility failure parameters, Kp.sw» K F,AUX> K F,C» and K F.D 
for each pertinent SIC number are obtained by applying Equations (7.3) 
and (7.4) to each equipment for each SIC number, and then using the 
methods described above to relate individual equipment types to overall 
failure parameters. The mean exposure-to-failure values are obtained from 
Table 7.2, the enclosure types from Table 7.3, and the penetration factors 
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TABLE 7.2 

MEAN EXPOS URE-TO-FAI LURE VALUES FOR TYPICAL EQUIPMENTS BY SIC NUMBER 


Facility and SIC Code 

Facility Equipment 

Mean Exposure 
to Failure 

(Fiber-sec/Meter 

Electric Utility 

Communications 

5 x 10 6 

SIC-49 i 

Common Controls 

7x10* 


Hiqh Voltage Switch Gear 

7 x 10 5 


High Voltage Bus 

1.6 x10 7 

Light Industries 

Primary Power 

(SIC-49) 

Small * 

Service Switch Gear 

7 x 10 5 

SIC-20, 23, 24, 27, 38 
Large - 

Power Distribution 

1.5 x 10 6 

Auxiliary Power 

2.2 x 10 5 

SIC-22. 25. 34, 35, 36 

Controller 

1 x 10 7 

Small Motors 

(Not Vulnerable) 


Interface Units 

1.4 x 10 5 


Hiqh Voltage Motor Controls 

1.4 xIO 5 


Servo Motor Circuits 

1 x 10 8 

i Heavily Automated Industries 

j SIC-26.28.29,30,33.37 

1 

Primary Power 

(SIC-49) 

Service Switch Gear 

7 x 10 5 

Auxiliary Power 

2.2 x 10 6 

i 

i 

Computer 

5 x 10 5 

1 

Keyboard/Display 

4.5 x 10 5 

j 

Controller 

1 x 10 7 

i 

j 

Interface Units 

1.4 x 10 5 


Servo Motor Circuits 

1 x 10 8 

j 

High Voltage Motor Controls 

1.4 x 10 5 


High Voltage Motors 

(Not Vulnerable) 

‘ Business Service 

Primary Power 

! (SIC-49) 

j SIC-60.62.63.73 

Service Switch Gear 

1 7x10 5 . 

Auxiliary Power 

! 2.2 x 10 6 

i 

Converter 

1 x 10 6 

! 

Computer 

5 x 10 5 

t 

i 

Keyboard/Display 

| 4.5 x 10 5 

; 

Processor 

1 x 10* 

j 

I/O Interface 

! 1 x io 7 


Keyboard/Display 

1 4.5 xIO 5 

J 

i Health Service 

Primary Power 

(SIC-49) 

SIC-80 

Service Switch Gear 

7 x 10 5 

Auxiliary Power 

j 2.2 xIO 6 

Communication Service {TELE) 

Primary Power 

i (SIC-49) 

1 

SIC-48 

Service Switch Gear 

i 7x10 5 

Auxiliary Power 

! 2.2 xIO 6 


Marker/Connectors 

! • 1 x 10 7 


Reqisters 

1 1 x 10 7 


Relay Switches 

' 7x10 5 

J 

Smalt Business 

Primary Power 

j (SIC-49) 

SIC-50-59. 99 

Power Distribution 

j 1.5 xIO 6 

Residential; 

Hiqh Fidelity Set 

6.6 xIO 5 

| TV Set 

1.7 x 10 7 
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TABLE 7.3 

ENCLOSURE TYPES FOR SIC-CODED BUSINESS AND INDUSTRY EQUIPMENTS 


Facility SIC Code 

Equipment or Equipment Module 

Enclosure Type 

Level 1 

Level 2 

Electric Utility 

Communications & Controls 

1 

- 

SIC-49 

High Voltage Switch Gear 

1 

7b 


High Voltage Bus 

- 

— 

Small Light Industry 

Service Switch Gear 

5b 

7b 

SIC-20, 24, 27 

Power Distribution 

2 

- 

SIC-23, 38 

Controller 8c Servo 

2 

- 

SIC-20, 38 

Servo Interface Unit 

2 

7b 

SIC-20, 38 

Controller 

2 

- 

SIC-23, 27 
SIC-24 

Motor Control Switch Gear 

2 

7a 

Large Light Industry 

Service Switch Gear 

5b 

7b 

SIC-22, 25, 34, 35, 36 

Auxiliary Power 

5b 


SIC-22, 36 

Controller & Switch 8c Servo 

3 

- 

SIC-25, 35 

Motor Control Switch Gear 

3 

7a 

SIC-34. 35, 36 

Line Controller 

3 

- 

Heavily Automated Industry 

Service Switch Gear 

5b 

7b 

SIC-26, 28, 29, 33, 37 

Auxiliary Power 

5b 

- 


Computers 8c Keyboard/Displays 

4 

- 

SIC-26, 33 

Controller 8c Motor Control Sw. 

3 

- 

SIC-28, 29, 30, 37 

Controller 8c Switch & Servo 

3 

- 

Business Service 

Power Distribution 8c Auxiliary Power 

5a 

- 

SIC-60,61,62,63 

Conv. 8c Comp. 8c Keyboard/Displays 

4 

- 

SIC-73 

Processor 8c I/O 8c Keyboard/Displays 

4 

- 

Air Transportation 

Service Switch Gear 


7b 

SIC-45 

Auxiliary Power 


. - 


Computer 8c Keyboard/Displays 


- 

Health Services 

Service Switch Gear 

KM 

7b 

SIC-80 

Auxiliary Power 

MM 

- 

Communications (TELE) 

Service Switch Gear 

4 

7b 

SIC-48 

Auxiliary Power 

4 

- 


Marker 8c Register 

4 

9b 


Line Switches 

4 

- 

Small Business 
SIC-50-59, 99 

Power Distribution 

11 

— 

Residential With Air Conditioning 

HIFI & TV Set 

10a 

- 

Without Air Conditioning 

HI FI & TV Set 

10b 

- 


Note: Enclosure types are defined in Table 6.1 
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from Table 6.2. The technique is illustrated by the following example for 
SIC 20: 

1. - From Figure 7.2 it can be seen that SIC 20 has service 

switchgear but no auxiliary power, no common equipment, 
and distributed modules consisting of controllers, inter- 
face units and servo circuits. 

2. From Table 7.2 the following mean-exposure- to-fai lure 

values are obtained (in units of fiber-seconds per cubic meter) 

• service switchgear; E = 7 x 10 s 

• controller; E = 1 x 10 7 

• interface unit; E = 1.4 x 10 5 

• servo circuits; E = 1 x 10 8 

3. From Table 7.3 it can be seen that service switchgear has two 
enclosures. Type 5b and Type 7b; controller + servo are in a 
single Type 2 enclosure, while the servo interface unit is 
inside a Type 7b enclosure within a Type 2 enclosure. 

4. Table 6.2 shows the following penetration factors: 

• Type 2; E/E 0 = .00989 

• Type 5b; E/E 0 = .0938 

• Type 7b; E/E 0 = .0164. 

5. Applying Equations (7.3) and (7.4) (cf p. 7-15): 

K F SW = ( Penetrat10n Factor, 5b) • (Penetration Factor, 7b) 

• (1 -e-service switch failure parameter) 

= (.0938) (.0164) (1-5-7 x 10 s ) = .22 x 10" 8 

K F,C = 0 

L n 5 (Penetration Factor 2) [(1 -r controller mean exposure- 
F,D to-failure) 

+ (Penetration Factor 7b) (1 -5- interface mean exposure- 

to-f allure) 

+ (1 -r servo mean exposure-to-failure)] 

= (.00989) [(1 -M0 7 ) + (.0164) (1-r 1.4 x 10 s ) 

+ (1-MO 8 )] = .22 x 10" 8 
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VIII. COSTS ASSOCIATED WITH EQUIPMENT FAILURES 


This section of the report presents ORI's methodology for deter- 
mining the costs associated with equipment failures resulting from an air- 
craft accident involving the release and subsequent dispersion of graphite 
fibers. These costs may be divided into two categories: 

• cost of cleanup and repair of affected electrical equipment 

• impact due to business and industry "dislocation." 
BUSINESS-INDUSTRY IMPACT 

The major goal in developing the methodology to use in this part 
of the model was to provide a rational means of relating Impacts in dollar 
values to graphite fiber incursions and the resulting equipment failures. 

A secondary but still large factor was the requirement that the method 
selected enable us to make use of available data. Several potential methods 
clearly required the collection of substantial amounts of data, so that 
candidate methods were screened rather critically against the data avail- 
ability criterion. We argued that economic losses resulting from equip- 
ment failures consist primarily of lost production, sales, and wages. We 
also recognized that, at least on the national level, the Gross National 
Product (GNP) measures the grand total of all goods and services produced In the 
country in one year. A related measure, the Gross Domestic Product (GDP) is a 
more useful measure for our purposes since it includes all goods and 
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services produced within the united States in a somewhat more rigorous way 
then the GNP. The value of goods and services produced by American corpora- 
tions overseas is included in the GNP but excluded from the GDP; similarly 
the GDP includes goods and services produced in the United States by 
foreign corporations. 

The selection of these measures as the major inputs for the cost 
calculations makes available a wealth of data collected primarily for 
other purposes. For example, projections of the national economy are typi- 
cally made in terms of the growth of the GNP, and in many cases, for parti- 
cular economic sectors. More pertinent to our requirements is the infor- 
mation tabulated by the Department of Commerce on a routine basis; it pro- 
vides national gross domestic product values for individual industries 
classified by their two-digit Standard Industrial Classification (SIC) 
designations. Sample SIC numbers were shown in Table 7.1 previously. With 
these data available at the national level, we sought to develop a method 
of allocating an appropriate fraction to each local area for which risk 
assessment calculations were to be made. This allocation was made on the 
basis of the ratio of the local payroll for a particular industrial sector 
to the national payroll in the same sector. Again this operation was 
facilitated by the availability of a major data base: the Bureau of Census 

publication County Business Patterns . These reports provide the number of 
establishments in different size groups, payroll, and employment for each 
SIC-coded business and industry category. A sample excerpt from this docu- 
ment appears in Figure 8.1. The basic assumption required in order to apply 
this allocation scheme is that the local productivity as measured by 
output per payroll dollar is equal to the national average productivity. 

The risk assessment model thus assumes that the impact of a car- 
bon fiber incident on the economy can be measured by the fraction of the 
local GDP allocated to a particular industry over the period of time that 
the industry is "down." In the absence of any other information we assumed 
that the down time would be of the order of one day and that cleanup costs 
could be satisfactorily represented by the GDP impact calculation. That is, 
we felt that the cleanup costs would be no more than of the same order 
of magnitude as that measured by the impact calculation. In view of the 
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Table 2. Counties — Employees, Payroll, and Establishments, by Industry: 1976 — Continued 
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FIGURE 8.1 EXCERPT FROM COUNTY BUSINESS PATTERNS, 
1976, FOR NEW JERSEY 


8-3 



estimated cleanup costs presented below, this assumption appears justified. 

It is recognized, however, that cleanup and restart costs are probably sen- 
sitive to industry type and this problem should receive additional atten- 
tion in the future. 

The next major step in developing the costing algorithm is the 
introduction of an expected value calculation. The calculation described 
in Section VII of this report is done for a particular small area. It is 
an estimate of the probability that a unit — building or plant — of a 
particular class of business or industry would have failed as a result 
of the graphite fiber incident. We then use it as an estimate of the 
fraction of that industry or business at that location that would be "knocked 
out" as the result of the graphite fiber incident. 

The method of calculating the impact in dollars for a particular 
location is to use the results of the calculations described in Section VII, 
Pp SIC , the probability of failure of a plant or business facility in a 

particular SIC number category in the following algorithm: 

r L p qTr 

Business-Industry Impact = S jq GDP SIC P F,SIC 

NP SIC 


National -level inputs from the Department of Commerce provide the national 
payroll broken out by SIC number, NP SIC> and the Gross Domestic Product 
broken out by SIC number, GD p SIC . Available data for counties surrounding 
the particular airport include the payroll for each SIC-coded business and 
industry; the local input for each individual geographical area is defined 
as LP SIC - 


In order to treat the government "business" impact we defined a 

new SIC number 99 for that industry. The national payroll and Gross Domestic 

Product were both assigned the value one, i.e.. 


NPgg = GDPgg = 1 

so that the resulting local domestic product for that class of business is 
equal to the local payroll only. The government payroll for each county is 
also reported in County Business Patterns . 
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The model computes the failure probability for each business and in- 
dustry category at one location. The resulting costs are then computed at that 
location* -using Equation (8.1). This provides the sum over all categories of 
business and industry at that location, which is then adjusted to account for 
the one-day impact assumption. The model then does the household impact cost- 
ing at that location. 

HOUSEHOLD IMPACT 

In order to compute the costs associated with the repair of household 
appliances we estimated the fraction of households that are air conditioned, 
defined by FAC. Using the methods described in Section VII, we obtained the 
failure probabilities for household appliances in air conditioned and non-air 
conditioned households. The overall failure probability depends on the ventila- 
tion parameters for typical residences that are air conditioned and those that 
are not air conditioned, and the mean exposure-to-failure for the equipment in 
question. If the resulting failure probabilities are Pp,AC ™ the air conditioned 
household and P F>NAC the non-air conditioned household, then the estimated 
cost to repair all damaged equipments of a particular class at all households 
in the geographical area is given by: 

Repair Cost x Number of Households x Number of Equipments per 
Household (Pp^C^C + ^F,NAC^ " PAC)} 

The locations and numbers of residential units were obtained from the 
latest (1977) Bureau of Census publication, County and City Data Book . Based 
on a general consensus of the NASA-ORI risk assessment team members, our atten- 
tion was limited to household television and high fidelity equipment. Other 
household equipments are reported to be relatively invulnerable. In many cases 
we were able to use local information sources to estimate the fraction of house- 
holds that are air conditioned; in any case we applied judgmental factors to 
adjust this factor as a function of geography. The grand average number of tele- 
vision sets and high fidelity sets (or low fidelity music systems) appears to be 
about one each per household. Where local Information was available we were able 
to adjust this ratio, but no generally available data source was identified as 
a result of contacts made with national organizations. Cleanup and repair costs 
for residential television sets and home music systems were developed from an in- 
formal survey of local service shops , as well as some conversations with the national 
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industry groups. The typical average cost to clean and repair a home tele- 
vision set is estimated to be fifty dollars; the average cost to clean and 
repair a stereo or high fidelity unit is estimated to be seventy-five dollars. 
While these costs are relatively modest, the general position of those in 
the business was that these repair costs were typical of equipment that 
would be repaired; in many cases a potentially higher repair cost for poor 
equipment would result in _a similar outlay for new equipment. 

DEFINITION OF GEOGRAPHICAL AREAS 

The description of the method used to define geographical locations 
at which the impact calculations are made is placed here since it is to a 
large extent dictated by the selection of the cost impact method just 
described. The use of a method that has as one of its major advantages 
the availability of a ready-made data base, also carries with it something 
of a disadvantage - namely, the fact that the data base is primarily at the 
county level. The individual county is not a uniformly defined entity in 
the United States. Fortunately the County Business Patterns does completely 
span the United States. That is, where an individual city, for example, 

Fairfax City, in the Virginia suburbs of Washington, D.C., is not a true 
county, it is nevertheless reported in the County Business Patterns as a 
separate entity. Further, counties are not of uniform size, business or 
population density, etc. 

In adapting the household and business data for computer input, 
we subdivided the counties into smaller, essentially homogeneous geographical 
units. In some cases different divisions were made for household data 
and business-industry data. In each case the center of the county or 
sub-county geographical unit was selected and a representative circle 
inscribed within the area. The input data set includes the coordinates 
of the center and the associated radius. The exposure and resulting impact 
calculations were made at five points within the circle. These points are 
the center and points a distance equal to two- thirds of the radius to the 
east, west, north and south of the center. The two-thirds value was selected 
as a result of the argument that, if the counties were equally spaced squares, 
say, these values would result in an equally spaced mesh. Our first inclination 
to use points on the circumference of the circle was discarded since it could 
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have resulted in calculations made at the same points, selected as repre- 
sentative of neighboring counties. In each case one-fifth of the input 
industrial business-industry payroll associated with the geographical unit 
is allocated to each of the five points. The calculation described in the 
preceding section is performed for each of the five points and totalled. 

Thus the result is an average of the impact over the geographical area, where 
the average is made after the final cost calculation. This method retains 
the necessary area sensitivity of the risk pheonomenon which is lost if all 
the business or industry is considered located at only one point. In that 
case we would tend to have a strongly binary risk mechanism. 

The concept is illustrated schematically in Figure 2.4, and by an 
actual example in Figure 8.2. This figure shows how Howard County, Maryland 
was defined for purposes of the graphite fiber risk assessment model input 
structure. The upper map in Figure 11 shows the location of Howard County 
relative to the Washington National Airport and the Washington, D.C., Balti- 
more, Maryland, and Wilmington, Delaware SMSA's. Those SIC code numbers 
associated with manufacturing were located within the circle about the 
industrial center encompassing the industrial sites shown on the lower map. 
Those businesses identified as service-oriented, and wholesale and retail 
trade were placed within the circle about the point identified as the 
commercial center. Residential units were divided between the two points 
defined as "residential" and "commercial and residential." 

CLEAN-UP AND REPAIR COSTS 

The ORI risk assessment team contacted representatives of several 
agencies participating in the national graphite fiber risk assessment program 
in its search for information concerning the cost of clean-up and repair 
of damaged electrical and electronic equipment. Although we determined that 
standard clean-up procedures appear to have been established, the cost and 
effectiveness of these procedures has not been thoroughly documented. 

In the absence of repair and clean-up cost estimates, ORI team 
members worked with the maintenance staff at Washington National Airport to 
develop original estimates of the labor required, and the associated cost, to 
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FIGURE 8.2 DESIGNATION OF AREAS FOR EXPOSURE AND COST COMPUTATIONS: 
HOWARD COUNTY, MARYLAND (LOWER) IDENTIFIED BY DARK BORDER IN MAP OF 
WASHINGTON-BALTIMORE AREA (UPPER). 









TABLE 8.1 


ESTIMATED CLEAN-UP AND REPAIR COSTS* 
AIR TRAFFIC CONTROL EQUIPMENT 


Equipment 

Labor in Man Hours 

**Cost ($) 

Terminal Board 

1 

$ 13 

Motor or Generator 

3 

39 

Processor 

24 

312 

Computer 

48 

624 

Communications 

(transmitter or receiver) 

1 

13 

VOR 



Solid State 

40 

520 

Tube 

80 

1040 

ILS 

20 

260 

Radar 

48 

624 

Console 

4 

52 


* Source: Maintenance staff, Washington National Airport and area labor 

rates. ($13 per hour). 

** Based on estimated time required. 
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clean up specific air traffic control equipments. The results are sum- 
marized in Table 8.1. Clean-up costs for generic types of equipment, such 
as computers and generators, may be transferrable to other settings, where 
similar pieces of equipment are used. 

Although clean-up and repair costs appear small relative to the 
economic impact of a complete shut down, it may be necessary to consider 
these smaller costs if they occur with greater frequency. This factor, 
as well as vulnerability of other household equipment should be considered 
in further refinements of this study. Also worthy of further examination 
is the impact of the one-day down time assumption on the variance. The use 
of the Gross Domestic Product in the calculation of impacts of carbon fiber 
on business and industry does provide some sensitivity to secondary economic 
effects. A more detailed analysis of these effects should be considered. 
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IX. DETAILED RESULTS FOR NATIONAL AIRPORT, 
WASHINGTON, D.C. 


SELECTION OF AIRPORT . 

National Airport was ORI's choice for the pilot analysis of its 
graphite-fiber risk assessment model. We had several reasons for selecting 
this airport for the initial study. ORI's Silver Spring, Maryland loca- 
tion is less than 20 miles from National. The airport is also close to 
densely populated areas in Northern Virginia, the District of Columbia, 
and the Baltimore-Washington corridor including the "new town" of Columbia. 
Of course. National is among the nation's busiest airports thereby giving 
it a greater potential for commercial aviation accidents than other, 
less heavily trafficked airports; National Airport's traffic load makes 
it about the tenth busiest airport in the country. 

National Airport and the surrounding area do not represent a great 
at-risk combination, however, because there is less industrial development 
in this region than in the metropolitan areas served by other major air- 
ports with similar traffic levels. This effect will become apparent in the 
comparative results presented in Chapter X. A map of the airport and sur- 
rounding areas was shown previously in Figure 8.2. The technique 
representing counties by inscribed circles, described earlier, was applied 
to Washington, D.C. and to the areas of Maryland and Virginia within about 
50 miles of National Airport. The methods described in Chapters VII and 
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VIII were used to prepare all model inputs for the transfer and business 
and residential impact calculations. 

The Washington National Airport calculations were carried out for 

the two periods of specific interest to NASA, 1985 and 1993, as is the case 

for all results presented in this report; the basic aircraft - carbon 

fiber inputs for these calculations were shown in Table 3.2. These values 
✓ . 

were essentially developed collectively by NASA and its contractors. The 
table shows that the amount of fiber per aircraft is expected to increase 
by approximately a factor of five during the 1985-1993 period, while the 
fraction of aircraft expected to have graphite composite in their structures 
increases by approximately a factor of two to three. Projected operations at 
Washington National Airport are shown in Table 9.1. 


Using the. results presented in Section III for fraction of air- 
craft involved in a fire for accidents in different operational phases, and 
the estimated factor of 20 percent for the fraction of fiber released, we 
obtain the results shown in Table 9.2 for amount of fiber released in an 
aircraft accident with fire. These are tabulated for accidents involving 
different aircraft (by size) in different operational phases. 

As an example of the calculation of the number of accidents, con- 
sider the 1993 scenario for Washington National Airport. The expected 
annual accident rate is obtained by using Equation (3.2) and the data pre- 
sented in Tables 3.2 and 9.1. The annual fire-fiber accident rate for 
large aircraft is given by (1993): 


29,621 

13,800,000 


x .50 x 6 = .00644 accidents/year 


This is the mean (X) used in the Poisson distribution that is sampled to 
determine the number of accidents for large jets in each replication of the 
stochastic model. As expected, the rate is quite small. 

In 50,000 replications (samples) of the 1993 scenario for 
Washington National Airport, the results for large aircraft were: 

• 49678 samples with no accident 

• 321 samples with one accident 

• 1 sample with two accidents. 
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TABLE 9.1 

PROJECTED WASHINGTON NATIONAL AIRPORT OPERATIONS* 


Aircraft 

Category 

1985 

1993** 

Large 

18,850 

29,621 

Medium 

124,766 

143,669 

Small 

60,284 

24,710 

Total U.S. 

11,700,000+ 

13,800,000+ 


* EPA-FAA aircraft emission data base maintained 
by ORI. 

** Projections are for 1995 - the closest to 1993 
for which data unavailable. 

t FAA Aviation Forecasts, Fiscal Years 1978-1989, 

U.S. Department of Transportation, f-AA, September 1977, 
Washington, D.C. and FAA Office of Aviation Policy 
(AVP-120) . 
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TABLE 9.2 


AMOUNT OF FIBER RELEASED (KILOGRAMS) 
PER FIRE-ACCIDENT 


Scenario 

Year 

Aircraft 

Size 

Operational Phase 

Takeoff 

Landing 

In-Flight 


Large 

18.1 

45.3 

27.2 

1985 

Medium 

5.4 

13.6 

8.2 


Small 

3,6 

9.1 

CJ1 

• 


Large 

81.6 

204.1 

122.5 

1993 

Medium 

27.2 

68.0 

40.8 


Small 

18.1 

45.3 

27.2 
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Corresponding estimates, based on the Poisson distribution are 49679, 320, 
and 1, respectively. The total number of accidents simulated is thus 323, 
while the rate (.00644) computed above, when multiplied by 50,000 yields 
322. For all three aircraft categories, the total number of accidents 
generated as a result of the random sampling process was 2430, while 
exact mathematical computation using the closed-form expression for the 
Poisson distributon would have led us to expect 2464, showing a deviation 
of only about one percent. 

For each accident that the Monte Carlo model generates, an opera- 
tional phase is randomly drawn from the relative frequency distribution 
obtained in Section III. The amount of fiber released is obtained from 
Table 9.2 and converted to individual fibers using the standard planning 
factor of 10 9 fiber fragments in one pound (.4536 kg) of carbon fiber. 

RESULTS FOR 1985 SCENARIO 

Most Costly Accidents 

The 1985 analysis is based on the results of 50,000 replications, 
using the inputs described above. An insight into the types of accidents 
and related damage and costs is obtained by inspecting the "ten worst 
accidents" shown in Table 9.3; prepared directly from outputs of the stochastic 
model. The highest cost accident had an estimated impact of $324,420. 

This accident occurred in replication number 47277. Costs of other acci- 
dents among the most costly ten fall off to a low of $95,519. Other in- 
formation in Table 9.3, shows that the ten worst accidents always in- 
volve the large and medium aircraft. Operational phases at the time of 
the accident are all landing, except for one takeoff. The stability class 
is always the most stable (Pasqui 11 -Gifford F). Wind speed is always the 
lowest input. value, 1.7 meters per second. Plume height is always 100 
meters, which is the value associated with the most stable condition . 

The table also shows the amount of fiber released in numbers of fibers, 
which is a function of aircraft category and operational phase at the 
time of the accident. 

The result that the ten worst accidents occur under the most stable 
meteorological conditions and lowest wind speed is consistent with the 
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TABLE 9.3 


CHARACTERISTICS OF 

TEN HIGHEST COST ACCIDENTS SIMULATED 
1985 - WASHINGTON NATIONAL AIRPORT - 50,000 REPLICATIONS 


Sample 

Number 

Aircraft 

Category 

Op.* 

Phase 

Stability 

Class** 

Wind 

Release 
(10 9 Fibers) 

Cost ($ 000) 

Speed 

(m/sec) 

Direction 

Res . 

Bus/Ind. 

Total 

47908 

Med 

TO 

F 

2 

162° 

12 

15 

81 

96 

26860 

Med 

L 

F 

2 

211° 

30 

16 

86 

102 

20948 

Med 

L 

F 

2 

214° 

30 

9 

105 

114 

11411 

Med 

L 

F 

2 

16° 

30 

2 

143 

145 

15613 

Large 

L 

F 

2 

194° 

100 

26 

151 

177 

1778 

Large 

L 

F 

2 

212° 

100 

40 

179 

219 

21900 

Large 

i 

L 

F 

2 

243° 

100 

65 

182 

247 

39020 

Large 

L 

F 

2 

153° 

100 

46 

224 

270 

13033 

Large 

L 

F 

2 

230° 

100 

62 

243 ' 

305 

47277 

Med 

L 

F 

2 

169° 

30 

7 

317 

324 


* T.O. = Take-Off 
L. - Landing 

** See Figures 5.1 and 5.2. 




dispersion model described in Chapter V. The most stable meteorological 
condition implies the smallest dispersion and therefore the greatest down- 
wind exposure. The most stable conditions are often associated with fog 
and haze with reduced visibility; they are most likely to occur in early 
morning and at night. In every accident identified in the table, the cost 
associated with equipment failures at industrial sites is greater than 
the cost associated with equipment failures at residences. 

Statistical Description of Results 

The frequency distribution of annual accident costs is shown in 
Table 9.4. The table shows the number of replications, or samples, in each 
cost class interval. The class intervals were selected to facilitate 
subsequent preparation of the risk profile; each interval is of equal size 
on a logarithmic scale. The frequency is tabulated for household damage 
cost, business-industry impact cost, and total cost. For example, out 
of 50,000 samples, the last column shows that 84 were associated with costs 
less than $178 but equal to or greater than $100. The last entry in the 
table shows that one accident had associated costs greater than or equal 
to $316,200 but less than $562,300. We identify this particular accident 
with the worst-case accident having a total associated cost of $324,420 
which was shown in Table 9.3. Also shown in the table Is the mean cost 
of $110 per year and the standard deviation of $3,377. 

Table 9.5 reorganizes the model's output data tabulated in Table 9.4. 
The data are accumulated over cost intervals and presented as a fraction of 
all samples for which the cost exceeds the stated limit. This is precisely 
the desired risk profile. Thus the fraction of samples in which household 
damage exceeded $100 is 0.00926; the fraction of samples in which industry 
damage exceeded $100 is 0.01288, and the fraction of samples in which the 
total damage to residences and industry combined exceeded $100 is 0.01416. 

The results shown in Table 9.5 are plotted in Figure 9.1, where both 1985 
and 1993 results are given. The curves are for total risk, using the sum of 
residential and industrial impact. 
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TABLE 9.4 


FREQUENCY DISTRIBUTION OF 50,000 SAMPLES BY COST 
WASHINGTON NATIONAL AIRPORT, 1985 SCENARIO 


Upper Limit 
of 

Class 

Interval ($) 

N 

umber of Samples 

Household 

Industry 

Total 

Costs 

100 

49,537 

49,356 

49,292 

178 

76 

88 

84 

316 

85 

79 

78 

562 

72 

75 

85 

1 ,000 


85 

86 

1,778 

50 

64 

84 

3,162 

46 

77 

87 

5,623 

25 

55 

62 

10,000 

18 

41 

45 

17,780 

12 

30 

39 

31 ,620 

2 

20 

24 

56,230 

4 

1 

16 

14 

100,000 

2 

6 

11 

177,800 

0 

3 

4 

316,200 

0 

4 

4 

562,300 

0 

1 

1 

Mean 

Standard 

Deviation 

Minimum 

Maximum 

21 

t 

641 

0 

64,922 

1 

89 

2,863 

0 

317,267 

no 

3,377 

0 

324,420 
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TABLE 9.5 

FRACTION OF SAMPLES IN WHICH COST EXCEEDED AMOUNT SHOWN 
WASHINGTON NATIONAL AIRPORT - 1985; 50,000 REPLICATIONS 


Cost ($) 

Fraction of Samples 

Household 

Industry 

Total 

100 

. 

0.00926 

0.01288 

0.01416 

178 

0.00774 

0.01112 

0.01248 

316 

0.00604 

0.00954 

0.01092 

562 

0.00460 

0.00804 

0.00922 

1,000 

0.00318 

0.00634 

0.00750 

1,778 

0.00218 

0.00506 

0.00582 

3,162 

0.00126 

0.00352 

0.00408 

5,623 

0.00076 

0.00242 

0.00284 

10,000 

0.00040 

0.00160 

0.00194 

17,780 

0.00016 

0.00100 

0.00116 


0.00012 

0.00060 

0.00068 


0.00004 

0.00028 

0.00040 

100,000 

0.0 

0.00016 

0.00018 

177,800 

0.0 

0.00010 

0.00010 

316,200 

0.0 

1 0.00002 

0.00002 
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PROBABILITY OF EXCEEDING COST SHOWN 



FIGURE 9.1 RISK PROFILES FOR WASHINGTON NATIONAL 
AIRPORT, BASE CASE, 1985 AND 1993 
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RESULTS FOR 1993 SCENARIO 

The 1993 calculations for Washington National Airport were carried 
out in the same fashion as the 1985 calculations. The differences between 
the 1993 and 1985 scenarios consist of increased use of graphite composite 
per aircraft, and increased use of aircraft with graphite composite in 
their structure, as well as projected changes in the number of aircraft 
operations for the different aircraft categories. The 1993 scenario 
inputs for graphite fiber released in the simulated aircraft fire- 
accidents are given in Table 9.2 as a function of aircraft category 
and operational phase; each aircraft with graphite fiber composite on 
board is expected to have about five times as much in 1993 as in 1985. 

The projected fraction of the civil aircraft fleet incorporating 
graphite fiber in their structure for the two time periods of interest 
is shown in Table 3.2. The fraction of aircraft in each size category in- 
corporating graphite fiber goes up by a factor of about two. Another 
factor to consider in looking at Washington National Airport is the pro- 
jected change in operations, shown above in Table 9.1. Operations of 
jet aircraft in the largest category are projected to increase by about 
50 percent (from 18,850 to 29,621), medium-sized aircraft operations in- 
crease about 15 percent, while operations Of the smallest aircraft are 
expected to decrease by approximately 60 percent. Thus, the outlook is 
for considerably more flights by the largest aircraft with the largest 
amount of fiber per aircraft. 

In summary, we project five times as much fiber per aircraft 
and approximately twice as many operations of aircraft with fiber on 
board (cf Tables 3.2 and 9.1); this suggests that we might expect about 
ten times the annual damage, which is what was found in the simulation 
results. The mean annual impact was $110 for 1985 and $1,167 for 1993. 

On the other hand, the average impact per accident was $4,991 for 1985 
and $24,000 for 1993. This factor of about five corresponds to the five- 
fold increase in amount of fiber per aircraft, indicating that at least 
in the low-risk domain the accident cost is approximately linear in amount 
of fiber released. 


9-11 



The risk profiles in Figure 9.1 show that the chance of exceeding 
$100 in total damage increased from .014 in 1985 to .038 in 1993. For 
$100,000.. the increase is from .00018 in 1985 to .0024 in 1993. This cor- 
responds to an increase in risk by a factor of about 2.5 for the low- 
cost end of the curve, and more than an order of magnitude increase -13- 
at the high-cost end. For a fixed risk probability of .01 the associated 
cost in 1985 is about $400, while for 1993 it is about $10,000, 

As in the 1985 calculations, all of the ten most costly 1993 ac- 
cidents (Table 9.6) occurred with the lowest wind speed, 1.7 meters per 
second under the most stable atmospheric condition; these accidents all 
occurred during landing. As pointed out earlier, the number of opera- 
tions at National Airport of aircraft incorporating graphite fiber is 
expected to increase by a factor of approximately two between 1985 and 
1993. This should be reflected in the statistics for the number of acci- 
dents in 50,000 sample replications. In fact, we found that for 1985 there 
were 1,068 samples in which one accident occurred and 17 in which two 
occurred. For 1993 there were 2,312 samples in which one accident occur- 
red and 59 in which two occurred. Thus, the simulation results reflect 
the projected doubling of operations by fiber-carrying aircraft. 

IMPACT OF CHANGE IN AMOUNT OF COMPOSITE ON BOARD 

Two additional sets of simulations were conducted for the 1993 
scenario at Washington National Airport. For each set all factors were 
the same as defined above for the 1993 scenario, except that in one case, 
the amount of graphite fiber per aircraft was increased by a factor of ten, 
and in the other, it was increased by a factor of 100. The increase in 
fiber translates directly (linearly) into increased exposure. The in- 
creased exposure appears to produce a less-than-linear corresponding in- 
crease in the resulting costs. 

The worst accident results were: 

• $4.1 million - 1993 scenario 

• $16.8 million - ten times the 1993 fiber 

• $31.4 million - 100 times the 1993 fiber. 
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TABLE 9.6 


CHARACTERISTICS OF 

TEN HIGHEST COST ACCIDENTS SIMULATED 
1993 r WASHINGTON NATIONAL AIRPORT - 50,000 REPLICATIONS 


Sample 

Number 

Ai rcraf t 
Category 

Op. * 
Phase 

Stability 
Class ** 

Wind 

Release 
(10^ Fibers) 

Cost ($ 000) 

Speed 

(m/sec) 

Direction 

Res. 

Bus/Ind. 

Total 

6954 

Med 

L 

F 

2 

181° 

150 

17 

593 

610 

15294 

Large 

L 

F 

2 

194° 

450 

93 

564 

657 

21462 

Large 

. L 

F 

2 

244° 

450 

241 

698 

939 

1746 

Large 

L 

F 

2 

212° 

450 

174 

782 

956 

2744 

Med 

L 

F 

2 

161° 

150 

70 

903 

973 

16280 

Med 

L 

F 

2 

183° 

150 

9 

1021 

1031 

11977 

Med 

L 

F 

2 

171° 

150 

100 

1003 

1103 

12756 

Large 

L 

F 

2 

230° 

450 

206 

984 

1190 

32749 

Med 

L 

F 

2 

165° 

150 

142 

1214 

1355 

46354 

Large 

L 

F 

2 

169° 

450 

101 

4023 

4124 


* L = Landing 

** See Figures 5.1 and 5.2. 



The average total annual cost went from $1,167 (1993 scenario) to 
$9,296 (10 x 1993 fiber) to $48,602 (100 x 1993 fiber). These increases 
are roughly factors of 8 and 5 for each successive 10- fold increase in 
fiber liberated. 

Figure 9.2 presents the test case risk profiles with the 1993 
scenario risk profile repeated for comparison. Where the annual costs 
are low and the associated level of risk is relatively high, the risk is 
relatively insensitive to the amount of fiber. For example, at the $100 
cost level the risk goes from just under .04 to just under .05. On the 
other hand, the .0001 risk of producing $1 million damage for the basic 
1993 scenario rises to .002 with ten times the fibers and to .01 with 100 
times the fibers. 

The principal term influencing the final cost impact is of the 

form: 



E 


where l is the mean exposure to failure of a specific type of equipment and 
V is the fraction of exterior exposure E that is experienced inside, where 
vulnerable equipment is located. The exterior exposure E is directly pro- 
portional to the amount of fiber released in the accident. Therefore, the 
ten-fold increase in fiber released can be considered a proxy for a ten- 
fold increase in V, or a decrease of E by a factor of ten, or an appro- 
priate combination of these. 

EXAMINATION OF DETAILED OUTPUT 

To this point the presentation has dealt almost entirely with ag- 
gregate statistics from the Washington National Airport computer runs. In 
order to give the reader a better understanding of the calculations that 
lead to the aggregate statistics, we will devote some space to a discussion 
of sample detailed results from the 100 times - 1993 scenario fiber re- 
lease impact set. This set of runs was selected for illustrative purposes 
because it is somewhat more dramatic than the base scenario simulations. 
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FIGURE 9.2. RISK PROFILES FOR WASHINGTON NATIONAL AIRPORT 
T993 SCENARIO INPUTS, 10 x 1993 FIBERS, 

100 x 1993 FIBERS 





The worst accident identified for the 100 x 1993 fiber release 
simulations occurred in sample number 1,746 with a 1.7 meter per second- 
212 0 wind, 4.5 x 10^ 3 fibers released, stability class F; the cost of res- 
idential repairs was $4,467,600, the industrial impact was $26,961,000, 
and the total cost was $31,429,000. We exercised an option available in 
the computer program to produce detailed output; the result for this ac- 
cident appears in Table 9.7. 

The accident location coordinates are X = 400, Y = -100 meters 
(measured from the tower at National Airport where X is positive to the 
east; Y is positive to the north). Residential points that were impacted 
are identified as 1, 6, 7, 8, 19, 20, 25, 30, 31, and 32 with X and Y 
coordinates given. The industrial points impacted were 1, 3, 7, 9, 13, 

23, 24, 25, 29, 31, 32, 35, and 36 with their X and Y coordinates also 
given. The coordinates are for the center of the circles drawn to re- 
present specific clusters of residences or businesses; the table also shows 
the radius for each circle (cf. Figure 2.4). Also shown in the table are 
values of the exterior exposure in fiber-seconds per cubic meter, the 
Gross Domestic Product per day for each business-industry location, 
and the cost associated with the failures at each location. The model 
provides an output for each exposure value greater than 0.5 fiber-second 
per cubic meter; for completeness we have tabulated all computer model- 
generated output results, even when the exposure and/or impact is essentially 
zero. The exposure values are for the center (X, Y) of each circle, while 
the dollar impact is the sum over all points within the circle of radius 
R about the center. 

The impacted points and the accident location are plotted in Figure 
9.3. Round dots represent residential sites; triangles, industrial sites. 
Site-identifying numbers appear to the left of the plotted points. The 
dashed line is in the downwind direction from the accident site. 

c 

The largest exterior dosage 106 x 10 fiber-sec m , was received 
at industrial site 13, which experienced only $34,000 damage. This was an 
almost complete shutdown (92%) at that site, which has a local daily Gross 
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TABLE 9.7 


DETAILS OF MOST COSTLY ACCIDENT 
WASHINGTON NATIONAL AIRPORT - 100 X 1993 FIBERS 
(Sample 1746, Large Aircraft, Landing Accident at X*400, Y--100 meters. 
Stability Class F, Wind 1.7 meters per second, 212°) 


Location 

Exterior 
Exposure o 

(Fiber-sec/M ) 

R(Km) 

GDP/ Day* 
($ 000) 

Cost 
($ 000) 

No. 

X(Km) 

Y ( Km) 

1 

4 

7 

6.2 x 10 6 

3 


536 

6 

35 

59 

27.9 x 10 6 

■ 4 


1078 

7 

25 

57 

0 

2 


0 

8 

30 

69 

0 

10 


3 

19 

15 

37 

0 

3 


0 

20 

21 

44 

71 .4 

2 


0.05 

25 

70 

12 

38.2 x 10 6 

4 


251 

30 

30 

45 

37.6 x 10 6 

2 


1392 

31 

35 

50 

4.9 x 10 6 

3 


732 

32 

38 

55 

7.4 x 10 6 

1 


475 

1 

4 

7 

6.2 x 10 6 

2 

853 

496 

3 

2 

3 

9.5 x 10 6 

2 

4021 

979 

7 

25 

55 

0 

2 

458 

0 

9 

36 

60 

35.2 x 10 6 

.1 

18976 

16,940 

13 

20 

32 

106.6 x 10 6 

2 

37 

34 

23 

9 

17 

.46 x 10 6 

5 

43 

26 

24 

13 

23 

12 x 10 6 

5 

58 

33 

25 

10 

8 

0 

4 

1774 

0 

29 

38 

44 

0 

4 

356 

0 

31 

32 

47 

18.5 x 10 6 

5 

890 

438 

32 

30 

50 

41 .8 x 

2 

890 

667 

35 

35 

47 

.11 x 10 6 

6 

24574 

7348 

36 

33 

43 

.011 x 10 6 

1 

593 

1 


* Shown only for business-industry locations. 
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domestic Product of only $37,000. The largest loss was a result of an ex- 
posure of 35 x 10 fiber-sec m at industrial site 9. The loss was 
$16,940,000, more than half (54%) of all costs resulting from this acci- 
dent. Industrial site 9 had an associated value (GDP) of $18,976,000, 
experiencing an 89 percent over-all impact. This site is the center of 
wholesale, retail, and financial services in Baltimore. The Baltimore 
residential area represented by site 6 and the suburban area represented 
by site 30 account for $1,078,000 and $1,392,000 costs respectively. The 
heavy financial impact of this particular accident is the consequence of 
a wind blowing directly from Washington National Airport to Baltimore. 

As a check on the manner in which aircraft accidents are seen to 
cause residential and industrial damage in this model, we also examined 
the 1993 base scenario for Washington National Airport. The most costly 
accident occurred under the same meteorological conditions. The resi- 
dential cost for this accident was $174,410; the industrial impact was 
$781,590; and the total cost was $956,000. Thus the cost associated 
with this accident changed by a factor of about 35 when the amount of 
fibers released changed by a factor of 100. 

As a matter of consistency, since all factors other than the 
amount of fiber is the same in the two calculations, we expect exposure 
in the base case to be related to exposure in the 100 x fiber case by a 
factor of 100. Comparison of the results showed that this did indeed 
occur. For instance, in Table 9.7, industrial sites 24 and 13 have ex- 
posures of 12 x 10^ and 107 x 10^ fiber-seconds per cubic meter re- 
spectively. The corresponding sites in the 1993 scenario had exposures 
of 12 x 10 4 and 100 x 10 4 . The costs do not decrease linearly with the 
decrease in exposure. This non-linearity is related to the fact that, in 
some cases, the overall failure probability is near 100 percent, indi- 
cating a saturation effect. The single largest impact cost for the base 
case appears at industrial site 9 just as it did in the 100 x 1993 fiber 
case. Again damage in the Baltimore area was the major contributor. 
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X. FURTHER ANALYSIS OF SINGLE AIRPORT RESULTS 


COMPARISON OF DIFFERENT AIRPORTS 

In this section we present the findings for three of the major airports 
treated in the risk analysis. These results supplement the detailed information 
on Washington National Airport that was presented in the preceding chapter. 

The three airport-city complexes discussed here are O’Hare/Chicago, Lambert/ 

St. Louis and Hartsfi el d/Atlanta. O'Hare is a busy airport (the nation's 
busiest commercial airport) serving a major metropolitan statistical area 
(SMSA) . St. Louis has half the number of aircraft operations and serves an 
SMSA with a considerably lower population. Atlanta has two-thirds the number 
of annual aircraft operations and serves a smaller SMSA. 

Population and aircraft operations data are shown in Table 10.1, with 
the average annual impact results, for these airport-city complexes, as well as 
Washington National Airport. As we might have expected, Chicago has the highest 
values for both household and business-industry costs, and therefore, in total 
costs. St. Louis shows by far the smallest costs. The ranking in terms of 
costs, whether residential or industrial impact or the sum of the two is: 

1 - Chicago 

2 - Washington 

3 - Atlanta 

4 - St. Louis 
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TABLE 10.1 

COMPARISON OF AVERAGE ANNUAL IMPACTS AT 
. FOUR AIRPORTS, 1993 SCENARIO 



ADJACENT SMSA 

NO. OF 

AVERAGE ANNUAL 

COSTS 

AIRPORT 

POPULATION 
(Millions, 1970) 

A/C OPERATIONS 
(Thousands, 1976) 

RESI- 

DENTIAL 

■HIEM 

Mm 

TOTAL 

National/ 

Washington 

2.9 

203 

$207 

$ 961 

$1,168 

O' Hare/ 
Chicago 

7.0 

577 

647 

2,Q93 

2,740 

Lambert/ 
St. Louis 

2.4 

178 

93 

; 194 

287 

Hartsfield/ 

Atlanta 

1 .6 

417 

198 

574 

772 


In costs due to damage to residences, Washington and Atlanta are very close 
(within 5 percent), but otherwise, mean damage costs tend to differ by factors 
of one and a half or more. In every case costs due to damage to industry are 
at least twice the costs associated with residential impact. 


It is also of some interest to compare the extreme values as well as 
averages. For this comparison we list the most costly accident that occurred 
in the simulated history at each of the airports. The most costly accidents 
that occurred at each airport in the base 1993 scenario cases were: 


Chicago 
Washington 
Atlanta 
St. Louis 


$6,209,800 

4,123,800 

1,317,500 

1,135,600 
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This ranking by most costly accident is the same as the ordering of airports 
by average annual impact. 

As noted for Washington, the ten worst accidents occur with the lowest 
wind speed and the most stable conditions. We recorded one serious (i.e., 
among the ten most costly) accident with a 5.7-meter per second wind at O' Hare 
Airport, and two such cases at St. Louis. St. Louis also differs from the other 
airports in having two in-flight accidents and one take-off accident among the 
ten worst accidents. Essentially all of the ten worst accidents at the other 
three airports occurred during the landing phase. The assumptions regarding 
the relation of fiber liberated to operational phase were set forth in Chapter 
VIII. It was shown there that the landing phase accidents lead to twice the 
amount of fiber liberated in a crash and fire that would occur during a takeoff 
or in-flight crash and fire. We would, therefore, expect landing accidents 
to predominate among the ten worst accidents. 

Figure 10.1 shows the risk profiles for these three airports and 
Washington National, for the base 1993 scenario. It illustrates the different 
risk profiles that result from differing demographic and economic patterns. As 
expected, the busiest airport with the most wealth in terms of both residences 
and industry at risk, Chicago/O'Hare (ORD) always shows consistently higher 
risk than the other airports. St. Louis/Lambert (STL) always shows the lowest 
risk. We account for this by both reduced aircraft operations and smaller 
population (and implied lower business-industry concentration) that may be 
impacted. The curves for Atlanta/Hartsfield (ATL) and Washington National 
Airport (DCA) lie between those for Chicago/O'Hare and St. Louis/Lambert and 
also cross each other. At the low-cost end Atlanta shows a higher probability 
of damage than Washington by a factor of two. At the high-cost end, the 
reverse is true. There DCA shows a higher probability, and again by approxi- 
mately a factor of two. There is a greater chance of impacting high-value 
business-industry concentrations in the Washington National Airport vicinity 
than there is near the Atlanta airport. 
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To round out the discussion of these airports, we summarize the risk 
results that were obtained for the 1985 scenario. The same general comments 
apply to the 1985 risk profiles that applied to the 1993 risk profiles: Chicago 

showed the highest impact, St. Louis the lowest. The risks were considerably 
lower for 1985 than for 1993. Chicago has a .09 risk at the $100 annual level 
for 1993, it has a .03 risk at the same level for 1985. The risk for Chicago 
is 0.005 at the $100,000 level for 1993 while it is 0.00045 at the same level 
for 1985. Similarly, for 1993, St. Louis shows a .003 risk of at least $100 
costs which is .007 in 1985. Where there was a .0005 risk of at least $100,000 
cost at St. Louis in 1993 the risk is .00002 for 1985. 

EFFECT OF INDUSTRY AT RISK 

Clearly one of the important factors in the graphite fiber impact is 
the presence of industry or population at risk within range of the downwind 
zone to be hit by the diffusing cloud of fibers. In order to demonstrate this 
effect dramatically we ran the 0RI risk assessment model for Philadelphia 
International Airport, for the 1993 scenario, for a special sensitivity test 
case — for which Philadelphia County was omitted from the input data set. 

All of the counties that lie at least partly within a 50-mile circle centered 
on the Philadelphia International Airport have a total business and industry 
payroll of approximately 18 billion dollars a year (1976). Philadelphia County, 
which contains the City of Philadelphia has an annual business and industry 
payroll of 5.5 billion dollars or more than 30 percent of the total within the 
50-mile circle. The results for this special run are shown in Figure 10.2 
where we have plotted the resulting risk profile as well as the risk profile 
for the Philadelphia International Airport with all data entered. We note 
that the removal of the industry and business in downtown Philadelphia from 
the risk calculation has its most significant impact on the high-cost portion 
of the risk profile. The mean and extreme values also show a considerable 
change as a result of dropping Philadelphia County out of the calculation. 

These results are summarized in Table 10.2. The impact is greatest for the 
high cost accidents; the average annual cost is decreased by a factor of 2.5 
while the average of the ten most costly accidents is decreased by a factor of 
about 3/5 when Philadelphia County's data is removed from the input set. 
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ANNUAL COST IN DOLLARS 


FIGURE 10.2. RISK PROFILES FOR PHILADELPHIA INTER 
NATIONAL AIRPORT, 1993 SCENARIO PHILADELPHIA 
COUNTY OMITTED FOR THE "W.O." CURVE 





TABLE 10.2 


SELECTED RESULTS FOR 
PHILADELPHIA INTERNATIONAL AIRPORT 
1993 SCENARIO 


MEASURE 

PHILADELPHIA COUNTY 

With 

Without 

Average Cost/Year 

$ 890 

$ 352 

Average Cost/Accident 

$ 17,396 

$ 6,880 

Average Cost/10 Most 
Costly Accidents 

$1,299,000 

$376,000 

Maximum Cost/Year 

$3,500,500 

$631,600 
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STATISTICAL CONFIDENCE LIMITS 

One of the important questions to be addressed in this risk assessment 
is the confidence with which our results can be viewed. One part of this 
question is addressed to the statistical confidence limits associated with the 
Monte Carlo model used to generate our risk profiles. This is the confidence 
with which the results can be accepted on the assumption that all input values 

are valid. 

To develop an expression for the statistical confidence limits, let 
p be the (unknown) probability of exceeding a damage level a at one airport - 
urban area complex in one year. Suppose that we have examined a sample of n 
years and that, of the n, we found r that had damage in excess of a. This is 
clearly one way of viewing the simulation model runs. In each replication our 
goal is to determine whether the cost due to graphite fiber related events is 
above or below the value c. This leads to our estimation of the probability 
of the cost being greater than x - the risk profile. Now we estimate the 

probability P fl by: 


and our statistical model is exactly that of Bernoulli trials. Each trial leads 
to a success, say, in which the annual accident-related cost is greater than or 
equal to $x or a failure, in which case the cost is below $x. 

Then, r is a random variable, the number of successes in n trials, and 
the probability that r = i is given by: 

Prob (r * 1) - <$) P 1 (1 - Pa)"' 1 

and the expected value of r is 
E (r) = nP a 

and the variance of r is 

Var (r) = nP a ( 1-P a ) 
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For the sample statistics, we can use the expression for P a and write, for 
the expected value: 

E (P.) -i E (r) - P, 

Similarly, the variance of P a is given by: 

Var (P a ) Var (r) - i P, (1-P,). 

In the absence of the complete population we only have the sample of 
runs that we have examined. In standard statistical fashion we estimate the 
sample moments from the sample statistics: 

Var (P a ) = P a (1-P a ) 
n 

A 

for a greater than zero. In many cases of interest P g is very small and we 
can write: 

Var (P a ) « P, 
n 

with negligible error. It has been demonstrated that, for the number of 
replications of the order of magnitude used in our analysis the distribution 
of sample results about the population results is approximately normal. 
Therefore, we can use the variance just derived to define confidence limits 
in the sense that 95 percent of the results obtained from additional sets 
of n replications will be within: 



Stated another way, the probability is 0.95 that the actual value of the 
probability P a is within these limits. 
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To illustrate this result we have shown the 95 percent confidence 
limits in the risk profile for the Washington National Airport 1993 scenario 
in Figure 10.3. In that case 50,000 replications were run. The statistical 
confidence limits shown at different points along the curve clearly demonstrate 
one feature of the problem that has been noted earlier: our relatively large 
uncertainty at the high-cost, low-probability end of the risk profile. This 
suggests that in future work the sampling plan be structured so that the tail 
of the distribution is oversampled. It is relatively uneconomical to simply 
increase the number of runs in order to get more data for the tail of the 
distribution. The square root of n appears in the denominator of our expression 
for the confidence limits - implying that we must do four times as many repli- 
cations in order to reduce the confidence limits by one-half. 

STABILITY OF THE SIMULATION MODEL 

One of the questions to be considered in running a model such as the 
0RI risk assessment model is the number of replications required and the related 
question of reproducibility. We have seen the number of runs required approached 
from the statistical confidence-limit point of view above. We now take a more 
pragmatic view of the problem. On a heuristic basis only we settled during 
early "production" runs on choosing a number of replications guaranteed to yield 
at least an expected 2,500 accidents. Computer time is essentially a linear 
function of the number of accidents simulated once a relatively small number 
of accidents is exceeded. Typical central processing unit time is 10-15 minutes 
to simulate 2,500 accidents and handle all associated input and output operations 
on an ITEL AS/5 computer. In order to further investigate the question of the 
appropriate number of replications we now use the simulation model results 
themselves . 

Impact of Number of Replications , 

To examine the matter of the appropriate number of runs we ran the 
LaGuardia Airport risk assessment calculation for the standard number. In 
this case' 35,000 replications was selected to yield an expected number of 
approximataly 2,500 accidents; as a test we also ran 18,000 replications. The 
results indicate a difference in mean annual cost of less than 20 percent 
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ANNUAL COST IN DOLLARS 



FIGURE 10.3. 1993 WASHINGTON NATIONAL AIRPORT RISK PROFILE 

SHOWING 95% STATISTICAL CONFIDENCE LIMITS* ASSOCIATED 
WITH MONTE CARLO PROCESS 


♦Non-SImultaneous 
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between the two sets of simulations, as shown in Table 10.3. The difference 
in the mean of the ten most costly accidents is greater than a factor of two, 
suggesting that the occurrence of the more costly accidents in the 35,000 - 
replication case has a strong impact on the mean annual costs. In Table 10.4 
we have tabulated the probability of the annual cost exceeding the values shown - 
the risk probabilities. The results are essentially identical until we get 
to the mi 11 ion-doll ar end of the curve. This result reinforces the earlier 
conclusion that we must be less confident about the results at the low-proba- 
bility tail of the risk profile than about other portions of the risk profile. 
With this caveat we conclude that the shape of the risk profile over most of its 
length would not be significantly influenced by more replications. 

Change in Accident Rate 

In another test of the sensitivity to parametric change we repeated 
the 1993 Washington National Airport calculations for twice the standard input 
accident rate. Using our basic rule of generating approximately 2,500 accidents, 
we conducted 50,000 replications resulting in 2,430 accidents for the standard 
accident rate (6 fire-accidents in the U.S. per year) and 25,000 replications 
resulting in 2,480 accidents for the double-accident rate. It can be shown 
that, if the probability of exceeding a given cost in a year is the product 
of the probability of having an accident and the conditional probability of 
exceeding the given cost, given an accident, the two sets of calculations have 
essentially the same statistical confidence limits. 

Our intuitive expectation in comparing the different accident rate 
results is that the annual risk should be doubled, but that the accident 
characteristics should be essentially unchanged. The risk probabilities are 
tabulated in Table 10.5. The 12 accident-per-year exceedance probabilities 
are double those for the 6 accident-per-year case except for the probability of 
exceeding $1 million a year. The mean cost per year is $1,167 for the 6-accident 
case and $2,067 for the 12 accident case. These results were influenced by one 
high-cost accident at $4 million. This accident occurred in replication 46354 
of the 6-accident runs and exceeded by about a factor of three the most costly 
accident in the 12-accident simulations, $1.4 million. Otherwise the most 
costly accident characteristics were quite similar. 
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TABLE 10.3 

COMPARISON OF RESULTS FOR DIFFERENT NUMBERS OF REPLICATIONS 
LA GUARDIA AIRPORT, 1993 SCENARIO 


NUMBER 

OF 

REPLICATIONS 

NUMBER 

OF 

ACCIDENTS 

GENERATED 

MEAN 

ANNUAL 

IMPACT 

MEAN OF 
TEN MOST 

COSTLY ACCIDENTS 

18,000 

1449 

$1390 


$613,000 

35,000 

2856 

$1660 


$1,400,000 


TABLE 10.4 

EXCEEDANCE PROBABILITY FOR DIFFERENT NUM3ER OF REPLICATIONS 
LAGUARDIA AIRPORT, 1993 


ANNUAL COST 

NO. OF RE 

PLICATIONS 

18,000 " 

35,000 

$ 100 

.064 

.066 

$ 1 ,000 

.045 

.046 

$ 10,000 

.014 

.015 

$ 100,000 

.0038 

.0037 

$1,000,000 

.00006* 

.00017** 


* 1 Case 
** 6 Cases 
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TABLE 10.5 


RISK PROFILE FOR DIFFERENT NATIONAL ACCIDENT RATES 
WASHINGTON NATIONAL AIRPORT/1993 


■m 

■ 

PROBABILITY C 

IF EXCEEDING COSTS 

| 

“ 12 ACCIDENTS/YR. 

$ 100 

.038 

.075 

$ 1,000 

.026 

.052 

$ 10,000 

.012 

.024 

$ 100,000 

.0024 

.0048 

$1,000,000 

! 

.0001 

.00016 
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XI. NATIONAL RISK 


METHOD 

In order to compute the national risk profiles we performed convolu- 
tions of various combinations of the probability density functions from which 
the individual airport risk profiles were obtained. The convolutions were run 
using the individual risk profiles which were generated for both the 1985 and 
1993 scenarios for the following nine airports: 

O' Hare/Chicago 

John F. Kennedy/New York City 

Washington National Airport/Washington, D.C. 

Lambert/St. Louis 

La Guardia/New York City 

Logan/Boston 

Hartsf i el d/Atl anta 

Miami International/Miami 

Philadelphia International/Philadelphia. 

In order to develop expressions for the probability of a given risk 
for the nation, or more specifically, for a group of airports, we first adopt 
the convention of replacing the continuous probability distribution for acci- 
dent-related costs at each airport by a discrete distribution. Since the 
class interval used for the discrete distribution can be made arbitrarily 
small, this implies very little loss in generality of the results. The cost 
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due to the impact of carbon fiber accidents on a national basis is a random 
variable that is the sum of random variables, the costs of accidents at 
individual airports. For ease of development, we first treat the case of 
only two airports. Let the probability of the cost at airport-city A due 
to aircraft-CF accidents being equal to rA$ be P(X=rA$) = a r . For the second 
city B define the corresponding expression P(Y=rA$) = b r . The sum of the 
costs incurred at both cities is a new random variable S=X+Y. The event S is 
the union of events: 

(X=0,Y=rA$) , (X=A$,Y=(r-l )A$) , (X=2A$,Y=(r-2)A$) . . . (X=rA$,Y=0) . 

If we let P(S=rA$) = c r , then 

c r = a 0 b r + a^b f + ... a r b Q (11.1) 

and the sequence {c p > is by definition the convolution of the sequence 
{a r } and the sequence {b r }. 

Now, define a generating function for the sequence {a k }: 

A(s) = Sa k s k 


and for the sequence {b k >: 

B(s) = %s k . 

Feller 1 shows that the generating function 

C(s) = Zc k s k 


is the product 

C(s) = A(s) B(s) 

or the random variable S=X+Y has the generating function A(s') B(s). The 
random variable X can represent the costs at a total of n city-airport com- 
binations, in which case the variable X+Y is the total cost for n+1 cities. 

In applying this result to the problem at hand, the probability distri- 
bution for the costs at each city derived from the Monte Carlo simulations is fit 
ted by a discrete distribution with a uniform class interval. The interval was 


1 William Feller, An Introduction to Probability Theory and Its Applications , 
Volume T , Third Edition. Wiley & Sons, I you. pp 266-267. 
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conveniently set at $50,000; comparisons were made to indicate that the final 
results were essentially unchanged for smaller class intervals. The proba- 
bility at the center of each interval is considered the coefficient of a 
term in a polynomial expansion, the generating function, with the power 
corresponding to the number of the class Interval. This polynomial is then 
multiplied by the polynomial previously obtained for n cities (n = 1 the 
first time through the procedure). The coefficients in the product polynomial, 
which is the generating function for the sum variable, are the probabilities 
for the costs in each class interval due to accidents at the n+1 cities. This 
result can be converted to a cumulative probability distribution, to provide 
the risk profile for the n+1 airports. 

APPLICATION 

The computer program which implemented this method is written so 
that it can accept an essentially unlimited number of input risk profiles. 

Each is first converted to a probability distribution - density function - 
prior to the convolution operation described above. The algorithm can also 
repeat the convolution operation using each distribution more than once if 
necessary; this is controlled by a set of inputs for each risk profile. The 
program also provides the mean value and standard deviation after each 
successive convolution is performed. 

In order to prepare an estimate for the national risk that we would 
expect to be on the high side, i.e. to bound the true value from above, we 
first note that the nine airports that were treated Individually account for 
approximately 25 percent of all commercial air operations in the United 
States. Our concept is to allow the nine airports for which the risk profiles 
were available to represent all of the air carrier operations in the U.S. 

We, therefore, generated a risk profile from the convolution of these nine 
airport risk profiles, with each airport's probability distribution convoluted 
with itself four times. This is essentially equivalent to assuming that the 
national risk is associated with 36 airports, of which 4 are identical to 
Philadelphia International, 4 to La Guardia, etc. Here the word "like" means 
with regard to graphite fiber risk. The resulting national risk profiles for 
the 1985 and 1993 basic scenarios are shown in Figure 11.1. 
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ANNUAL COST IN DOLLARS 


FIGURE 11.1. NATIONAL RISK PROFILES PREPARED BY CONVOLUTION OF NINE 
INDIVIDUAL AIRPORT ACCIDENT-COST PROBABILITY DISTRIBUTIONS 
ADJUSTED TO ACCOUNT FOR ALL U.S. AIR CARRIER OPERATIONS 

Number of convolutions adjusted for population and traffic 

_Each distribution convoluted four times 
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The convolution described above does not take account of the differ- 
ences in risk that might be related to size of airport and surrounding 
industrialization. We, therefore, used the nine airport-urban complex com- 
binations in a more structured approach. With the exclusion of Atlanta, 
Philadelphia, and Miami, all of the airports are characterized as large, both 
in number of operations and in adjacent population. Each is in a Standard 
Metropolitan Statistical Area with more than 2,000,000 population. Each had 
more than 150,000 operations in 1976. This group, because of the obvious 
concentration of risk, received most of our attention in the conduct of the 
individual airport risk assessments. In performing the second national risk 
convolution several of the airports were used twice (all except O'Hare/ 

Chicago and Lambert/St. Louis) in order to account for all operations in this 
number of operations - population group. 

The remaining airports represent different population concentrations 
and/or number-of-operations categories. Atlanta and Miami are both busy air- 
ports, with more than 150,000 operations a year but are adjacent to metro- 
politan areas with populations only between one and two million. Philadelphia 
is in a metropolitan area with a population greater than two million but has 
less than 150,000 operations a year. The probability distributions for the 
risk at these three airports were used nine times in order to simulate the 
impact on the national risk of the remainder of the national air carrier 
traffic. The resulting number of air carrier operations is equal to all 
operations not previously accounted for by the busier airports serving larger 
population centers treated in the preceding paragraph. These airports are 
thus proxies for smaller airport-population center combinations. The resulting 
risk profiles for 1985 and 1993 are also shown in Figure 11.1. The expected 
annual financial impact due to graphite fiber incidents associated with air- 
craft accidents in the United States are tabulated in Table 11.1 for the 
different cases described here. 

For purposes of comparison with other results in the risk assessment 
field we have superimposed the 0RI 1993 national risk profile (9 airports 
convoluted four times) on the results published by the U.S. Nuclear Regulatory 
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TABLE 11.1 

ESTIMATED U.S. ANNUAL IMPACT AIRCRAFT- 
ACCIDENT RELATED GRAPHITE FIBER INCIDENTS 


CONVOLUTION RESULTS USING NINE AIRPORT RISK PROFILES 
TO ACCOUNT FOR ALL U.S. AIR CARRIER OPERATIONS 


CONVOLUTION DESCRIPTION 


1985 

1993 

Each airport convoluted 

Mean 

$ 

3,499 

i$ 

38,541 

four times 

Standard 



i$ 



deviation 

$ 

32,423 

242,946 

Number of convolutions 

Mean 

$ 

2,556 

$ 

27,709 

adjusted by airport-city 

Standard 





size category 

deviation 

$ 

26,070 

$ 

173,560 
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Commission 2 (The Reactor Safety Study, sponsored by the U.S. Atomic Energy 
Commission, performed under the independent direction of Professor Norman 
C. Rasmussen of the Massachusetts Institute of Technology) in Figure 11.2. 

The results indicate that the national graphite fiber risk appears to be 
somewhat below that which the nuclear reactor safety study group estimated 
for 100 nuclear power plants, at least over the damage range for which the 
results are plotted. Apparently the graphite fiber risk is somewhat higher 
for lower values of property damage, which in the ORI case is the sum of 
business dislocation and household impact. Among the approximations made by 
the ORI team, we note that our 1993 calculations were carried out in 1976 
dollars, using 1976 Gross Domestic Product data. The use of constant dollars 
is reasonable in order to make results interpretable in the current time 
frame. The Gross Domestic Product was not adjusted in order to facilitate 
the 1985-1993 comparisons. Once we consider comparisons with other investi- 
gators, however, it would probably be desirable to adjust these inputs for 
the time frame of interest. 

STATISTICAL CONFIDENCE LIMITS 

The calculation of statistical confidence limits for the convoluted 
probability distributions, given those for the individual risk profiles, is 
by no means a trivial problem. In this section we present a brief derivation 
of an approximate form for the calculation which we have used. It depends on 
standard methods used in similar problems, as well as particular insights 
unique to the problem at hand. 

As in the derivation of the expression for the convolution, first 
assume that the probability distribution is a discrete function. This does 
not affect the generality of the result but does simplify the notation; it 
is equivalent to allowing the dollar value of the annual impact to take on 
only discrete values, rather than considering it a continuous variable. The 
probability that the sum of the costs at two cities is equal to rA$ dollars 

2 U.S. Nuclear Regulatory Commission, Reactor Safety Study: An Assessment. 

of Accident Risks in U.S. Commercial Nuclear Power Plants, Wash- 1400 
(NUREG-75/01 4) October iy'/b. 
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FREQUENCY (EVENTS/YEAR) 



10 5 10 6 10 7 10 8 10 9 10 10 10 11 
PROPERTY DAMAGE/ANNUAL IMPACT (DOLLARS) 


FIGURE 11.2. COMPARISON OF RISK PROFILES - 
NATIONAL RISK PROFILE ("ORI") vs, 

RESULTS PUBLISHED BY U.S. NUCLEAR REGULATORY COMMISSION* 


*U.S. Nuclear Regulatory Commission, op. cit . 


11-8 




is given by Equation (11.1) which represents the result of the convolution 
of the probability distributions for the two airports. Now invoke several 
features of the problem at hand. The dominant factor in the analysis of the 
airports reported earlier in this document is that the probability of the 
cost being zero in any year is very large compared to the probability associ- 
ated with any other cost. This is due, as noted earlier, to the fact that an 
aircraft accident accompanied by fire is a relatively rare event at any one 
airport. This can be expressed as: 


and 


a Q » a-j for i>0 

b Q » bj for j>0. 


As long as the number of terms in Equation (11.1) is finite, the sum of terms 
of the form a n b k _ n for n>0 is small compared to the sum of a Q b k and a k b Q . 

This leads to the following approximation for c p : 

c r ~ a o b r + a r b o <11,2) 


Since the cost probabilities at each city fill the entire sample 

space: 

a = 1 - E a • 

° i=i 1 

and 

b = 1 - l b-. 

0 j-1 J 

Each sum is equivalent to the probability of having at least one accident in 
a year at each airport, typically of the order of magnitude of 1/100. Taking 
advantage of this fact, the estimate of the probability that the total cost 
at the two airports is equal to rA$ dollars may then be written: 

c r « a r + b r (11 *3) 
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t 

The risk profile shows the probability that the cost equals or 
exceeds a given value in a year. Define the probability of this event as: 

C r = P (S > rA$) = A r + B r . 

Define the estimate of by the symbol C r . In Chapter X it was shown that 
the variance of A r and B r may be estimated by: 

var A r = [A r (1-A r )] / n 

var B r = [B r (1-B r )] / m 

where n and m are the number of trials (replications) used to estimate A r and 
B f , respectively. Since the accidents at two or more airports are assumed to 
be independent events, that is, uncorrelated, we may write the variance of 
C r as: 

AAA 

var C r = var A r + var B r 

If M is defined as the smaller of n and m, then 

var C r < (1/M) [A p (1-A p ) + B f (1-B r )] 
and introducing an approximation of the same order as previously employed, 

var C r * (1/M) [A f + B r ] 

var C * C / M (11 .5) 

r r 

Equation (11.5) applies to two airports. To extend the result to 
the more general case of n airports consider the expression for three airports 
Let 

D(s) = Ed k s k 

be the generating function for the sequence {d^} representing the probabili- 
ties at the third airport, in exact analogy to the relations presented earlier 
The convolution operation is associative and commutative. The probability 
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that the sum of the costs of accidents at all three airports is equal to r 
can be written: 

e r = d o c r + d l c r-l + d 2 c r-2 + d r-l c l + d r c o 

as in Equation (11.1). Substituting for the c's from Equation (11.2) this 
expression can be written: 


e^ = d. (aJT + a„b.) + d-, 
r o o r r o' i 


(a b i + 
v o r-l 


a ib ) + 
r-l o' 


•• d r-l < a o b 1 + a l b o> + 


dab 

TOO 


Introducing the same approximation used previously in deriving Equation (11.3) 
provides the following approximate results: 


e -dab + d b a + abd 
r o or o or o o r 


and 

e r 55 a r + b r + d r (H- 6 ) 

Equation (11.6) implies, by induction, that the expression (11.5) can 
be used to estimate the statistical confidence limits for the convolution 
used to generate the national risk profile. It is relatively conservative 
to assume further that the distribution of estimates about the true population 
values of the probabilities are normally distributed. It can then be stated 
that 95 percent of the values resulting from the simulation runs lie within 
± 2*vic r /M of the actual computed value, as shown in Figure 11.3 for M = 50,000. 
These results are statistical confidence limits for different values of the 
risk probability, and are related only to the confidence associated with the 
Monte Carlo sampling errors. They do not reflect uncertainty in the input 
parameter values; some insight into input error effects can be gained by 
examining the sensitivity analyses reported in Chapter X. 
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APPENDIX A 


COMPUTER PROGRAM DOCUMENTATION 


(Bound Separately) 
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APPENDIX B 

BASELINE FACILITY DESCRIPTIONS 


INTRODUCTION 

This appendix summarizes the facility descriptions used as a base- 
line for developing the penetration values, failure constants, and failure 
models described in Sections VI and VII. of this report. 

Methods 

Facility definitions for this study are based on the U.S. Census 
Standard Industrial Classification (SIC) Code numbers. These SIC codes pro- 
vide a standardized basis for defining facilities in a manner that is directly 
relatable to demographic areas for which Census data are readily available. 

The types and configurations of equipments which most generally typify 
a facility identified by a specific SIC number were obtained through a broad 
literature search supported by a limited number of site visits, augmented by 
discussions with representatives of various industries. The equipment types 
and their specific components identified by the SIC number with each SIC 
facility are then compared against the equipment types and designs contained 
in failure threshold data from the Ballistics Research Laboratory (BRL). 
Exposure threshold values which appear to best fit the situation are assigned. 

Buildings and enclosures are specified for typical facilities and 
equipments; these were compared with air conditioning and ventilation standards 
published in several handbooks. Note that the actual building size is not 
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particularly important as long as design is in accordance with standard prac- 
tice, since the standards are aimed at maintaining ventilation constant in 
terms of air changes per hour regardless of the building size. 

Facility descriptions were obtained from the sources listed in 
Section VII. Air conditioning and ventilation standards and practices were 

obtained from the Handbook of Air Conditioning System Design 1 and the 
Standard Handbook of Mechanical Engineers 2 . 

Problems and Assumptions 

There are, of course, a wide range of facilities, in terms of size 
and type, of interest to us in this risk assessment investigation. There is 
also a wide range of types of equipment from facility to facility, and even 
within facilities of the same type. In some instances there may be greater 
differences between equipments and designs within facilities characterized by 
the same SIC code number than between those with different SIC code numbers. 

For example, the circuits used for relay-type telephone switching are very 
similar to those used for supervisory controls in transportation and utilities, 
and not at all similar to the electronic switching used in newer telephone 
central offices. 

The only approach considered practical in this study was to define as 
"typical" facilities believed to best represent the facilities identified by 
each SIC code number during the time frame of interest, and to base penetra- 
tion values and facility failure computations on these "typical" facilities. 

A facility is defined on the basis of those equipments or components 
which appear to dominate the facility's vulnerability to carbon fiber penetra- 
tion and subsequent equipment failure. A modular approach was used, synthesiz- 
ing facilities from a few generic types of equipment for which mean exposure- 
to-failure values are reasonably well established. The relationship between 


1 Carrier Air Conditioning 6. Handbook of Air Conditioning System Design, 
McGraw-Hill Book Co., 1965. 

2 Baumeister and Marks, Standard Handbook for Mechanical Engineers , McGraw- 
Hill Book Co. , 1967. 
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facilities of interest and the equipments for which generic failure data are 
available is very loose. The published value for the equipment which most 
closely represents the equipment of interest was used. In many instances the 
equipment of interest is assumed equivalent to a multiple of the generic com- 
ponents (e.g., a process control station might be assumed equivalent to 10 of 
the TTL-PC boards for which test data are available, and would then be assumed 
to be 10 times more vulnerable). 

The published failure exposure values are often based on fiber types 
and sizes, air flow rates, etc., not representative of conditions expected in 
this analysis. Care was taken to select the most appropriate value possible. 
Specific assumptions are defined below as they relate to particular facilities. 

ELECTRIC UTILITIES 

Conventional electric utility stations are considered in this study. 

It was agreed early in this project that NASA Langley Research Center would 
investigate the potential vulnerability of nuclear power stations. Electric 
utilities can be described in terms of the following functions: 

• Generation 

• Transmission 

• Distribution 

These functions are performed by the following basic types of subsystems: 

• High voltage 

• Control 

• Communications 

Electric utility facilities consist of a network of generating stations, 
transmission (switching) stations, and distribution stations. Often these 
three functions are combined in a single station. 

System Configurations 

Figure B.l illustrates a typical configuration of generators (circles), 
circuit breakers (boxes), transformers and buses, and transmission lines in a 
power system. Secondary stations are discussed under industries, hospitals, 
etc. Generators are usually arranged in the generator— step up transformer- 
breaker — high voltage bus segment module as shown so that loss of a single 
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FIGURE B.l ILLUSTRATION OF A POWER SYSTEM 
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generator unit does not result in the loss of a multi -generator station. Breakers 
are arranged to control, protect, and isolate each bus segment, each transmission 
line and each major transformer, as indicated. 

Station Configurations 

Figure B.2 illustrates a typical utility station or substation confi- 
guration. Communications and common control equipment are common to all station 
functions. High voltage bus structures and their associated transformers and 
breakers are usually located outside the station building. Each bus section, 
each generator, etc. has its own associated controls in a section of the 
switchgear panel inside the station building (or in a special enclosure when 
located outside in a unit type of substation). 

The high voltage subsystem at each station consists of high voltage 
buses, breakers, transformers, and high voltage transmission lines together 
with their associated disconnect switches, fuses, insulators and bushings. 
Insulators and bushings are the most vulnerable equipment from the standpoint 
of carbon fibers. 

Generators , as well as transformers and breakers and other high 
voltage equipment such as rotary converters, are well sealed and often pres- 
surized so that they can be neglected as far as their vulnerability to carbon 
fibers is concerned. 

Switchgear Controls. Generators and breakers are controlled and 
protected by means of switchgear consisting of switches, electromagnetic and 
solid-state relays, terminal boards and associated wiring. Most breaker 
tripping circuits are 125 Volts DC although some stations use 250 Volts DC. 
Switchgear panels at generating stations may also contain field exciters (e.g., 
thyratrons) operating at 125, 250, or 375 Volts DC. Specific switchgear panels 
or panel sections are usually assigned to each generator, each transmission 
line, and each bus and associated transformers so that switchgear failures 
tend to affect only their associated portions of the station. Switchgear is 
highly standardized so that panels are quite similar whether for use with 
generators, transmission lines, or buses and associated transformers. 
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FIGURE B.2. ILLUSTRATION OF A UTILITY STATION CONFIGURATION 




Common controls consist of interface units used to input supervisory 
controls to the switchgear panels and to monitor output signals from the 
panels to produce alarms etc. for transmission via the communications system. 

Communi cations are used for remote control of unmanned stations, to 
obtain load management and to obtain better system coordination in the event 
of system faults. The communications subsystem is particularly important in 
restoring a system after a major outage. Communications systems may use 
older telephone (relay) type or newer solid-state supervisory controls. Newer 
stations may have solid-state minicomputers for A/D conversion, interface with 
station controls, etc. TTL logic is typically used. Communication links may 
be via telephone lines, microwave, or via carrier on HV transmission lines. 

Failure Parameters 

The methods used to estimate mean exposure- to- failure values are 
described in this section. Each generator unit, each transmission line, and 
each bus segment/transformer is assumed to consist of a high voltage module, 
a switchgear panel, and associated communication interface. The communica- 
tions/common control subsystem is assumed to be associated with the entire 
station. No attempt is made to account for the length of exposed transmission 
or distribution lines. 

9 All high voltage modules (or bays) are assumed to be similar. 

The vulnerability of each high voltage module, including trans- 
former bushings, is assumed equal to the average values obtained 
by BRL at 25 KV. Vulnerability is assumed constant with voltage 
since the design factors of insulators, gaps, etc., are intended 
to compensate for voltage: E 2? 1*6 x 10 

• All switchgear panels are assumed to be similar. The vulner- 

ability of each switchgear panel is assumed equal to the generic 
value for relay and control logic from BRL: E ^ 7 x 10 5 

• The vulnerability of each control interface assumes use of a 
single TTL printed IC board: E * 7 x 10 8 

• The station communication system is assumed to consist of a 
processor equivalent to the PDP-8 (E * 1 x 10 7 ) together with 

3 All values are expressed in fiber-seconds/meter 3 unless otherwise noted. 
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a microwave transmitter-receiver (E ^ 1 x 10 7 ), for an overall 
vulnerability IT^ 5 x 10 6 . 

Buildings and Enclosures 

Typical substation buildings are small sheet metal buildings with 
industrial type doors and windows with weatherstripping. They are typically 
air conditioned with window units to provide 2 or 3 air changes per hour. 
Switchgear panels are housed in standard metal switchgear panels without 
forced ventilation (see, for example, Westinghouse Construction Specifications 
Cat. 55-000 , 57H Edition, 1978-1979). Enclosures for common controls and 
communications can be neglected because they are already accounted for in 
failure testing. 

INDUSTRIAL PLANTS 

From the standpoint of vulnerability, an industrial plant can be 
defined in terms of: 

• Process controls 

t Power 

• Communications (will not be critical in many types of 
industries) . 

Although there is a large variety of types and sizes of industrial plants, 
modularization of process controls has been developed to the degree that 
similar equipment modules may be added together to handle nearly any kind 
and size of application. In the paragraphs below, generalized configura- 
tions and equipment modules are first described, followed by pertinent 
detailed applications. 

Typical Configuration (and Notes on its Application) 

Figure B.3 shows a typical arrangement of power inputs, communica- 
tions, central computer, controllers, and machine stations in a highly 
automated industrial plant. This type of configuration is found in industrial 
systems of all types ranging from steel mills to bakeries, printing plants, 
and test facilities. Each of the major elements in this typical configuration 
is discussed in turn here: 
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fIGURE B.3. TYPICAL INDUSTRIAL PLANT CONFIGURATION 


H MACHINE 
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Power for a large industry may include a substation equivalent to a 
major utility distribution substation with primary voltage in the major trans- 
mission (e.g., 230 KV) range. Smaller industries may have a secondary unit- 
type substation with primary voltages in the 13.8 KV to 34.5 KV range. Heavy 
industries may require secondary voltages as high as 13.8 KV. Typical pro- 
cess industries require secondary voltages of 120 V, 208 V, and 480 V AC. 

The outside (high voltage portion of an industrial power substation) 
is treated as part of the public utility system even though it may be owned 
by either the utility or by the industrial plant. The failure of that high 
voltage part of the power system is included in the failure calculation for 
the primary power system (SIC 49). Primary power enters the larger industrial 
plants through service switchgear located inside the plant. 

Service Switchgear includes step-down transformers, enclosed breakers, 
contactors, relays and manual switches. Service switchgear receives the pri- 
mary power and delivers 120 V, 208 V, 408 V, and sometimes 480 V and 600 V to 
the plant or installation. 

Distribution Panels . For small, low energy-consuming industries, 
primary power may be received directly at 120/240 V and enters the industry 
through a distribution panel consisting of breaker-switches and fused feeders. 

Auxiliary Power . Most industrial plants are assumed to have engine- 
driven generators to provide power in the event of failure to the primary power. 
Small light industries are assumed to have no auxiliary power. 

Central Computers . These are used in highly automated industries to 
provide overall (executive) control of the process. Redundant computers and 
keyboard/display terminals are often used to minimize outage time in the event 
of failures. 

Station Controllers . Minicomputers or microprocessors are used to 
provide local processing at each machine station. These may be used in con- 
junction with a Central Computer or may stand alone. 

Interface Units. In 1975 the IEEE adopted a standard module for the 
interface unit and station controller called CAMAC. (IEEE Spectrum, April 1976). 
These modules provide a flexible interface between nearly any type of industrial 
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process and any type of central computer. Future systems can be expected to 
have this type of modularity. The CAMAC interface unit can accommodate a 
large variety of available connectors, buffers, clocks, registers, readers, 
displays, etc. while the controller module can accommodate numerous mini- 
computers such as the PDP-8. Examples of plants using this concept are an 
aluminum plant in which 23 CAMAC modules control 45 preheat furnaces,. a 
computerized steel slab casting mill, and a General Motors test facility. 

A typical variation on the above scheme is the use of a low-cost 
programnable controller at each machine station without a central computer. 
Originally developed for control of machine tools and assembly operations, 
programmable controllers are currently in use in chemical, petrochemical, 
food processing, pharmaceutical, paper, and other industries. 

Processing Components . These make heavy use of solid state TTL 
but these are being replaced with CMOS because of better noise immunity 
and lower power requirements. Programmable controllers and interface units 
often use microprocessor chips. 

Machine Drives and Sensor/Encoders . These cannot be easily typified 
since they are designed to fit the particular type of machine station. 

Machine drives will include components such as motor controls, servos, in- 
jectors, solenoids, etc. Sensor/encoders will include components such as 
pressure or temperature transducers, motion encoders, etc. 

When machine stations perform low energy precision operations for 
material handling, milling machines, etc., it is assumed. that machine drive 
functions will be performed by servo systems. When machine stations consist 
of heavy duty motors (as in rolling mills) it is assumed that machine.drive 
functions will require high voltage motor contactors and controls. High 
voltage switchgear is required for this. 

Small Industrial Plants 

Small industrial plants are characterized by machine stations with 
small or medium-duty motors and/or servo units. These facilities are assumed 
to have no auxiliary power, and no central computer or displays. The SIC 
codes listed below are assumed to fall into this category even though these 
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SIC codes are sometimes characterized by large highly automated facilities. 
Specific plants (identified by SIC number) typically have the following 
characteristics: 

• SIC 20 - Food processing plants are assumed to have machine 
stations consisting of station controllers, interface units, 
and servos together with small motors. Power enters through 
service switchgear. 

• SIC 23 - Apparel plants are assumed to have machine stations 
consisting of small motors run directly from station controllers. 
Primary power is assumed to be received at 115/230 V and goes 
directly into low voltage distribution panels without use of 
service switchgear. 

• SIC 24 - Lumber and wood products plants are assumed to have 
machine stations consisting of medium duty motors and high 
voltage control switches (used to drive saws, planers, and 
shapers), without use of station controllers. Power entrance is 
through service switchgear. 

t SIC 27 - Printing and publishing plants are assumed to have 
machine stations consisting of small motors run directly from 
station controllers. 

• SIC 38 - Instruments Plants are assumed to have machine stations 
consisting of controllers, interface units, and servos. Primary 
power is assumed to be received directly at 115/230 V and to go 
directly to power distribution panels without use of service 
switchgear. 

Large Light Industries 

Large light industries are similar to small light industries except 
that they are assumed to have auxiliary power available. All are assumed to 
receive primary power through service switchgear. Machine stations are as 
follows: 
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• SIC 22 - Textile mill products plants are assumed to have work 
stations consisting of station controllers, interface units, 
and servo units, together with small motors which are neglected 
for failure calculation purposes. 

• SIC 25 - Furniture plants are assumed to have work stations 
consisting of high voltage controllers and motors driving 
dimension saws, planers, shapers/routers, and sanders, without 
the use of station controllers (non-automatic). 

• SIC 34 - Fabricated metal plants are assumed to have work stations 
with line controllers, high voltage motor control and motors 
driving machine tools, presses, etc. 

• SIC 35 - Machinery plants are assumed to have work stations 
similar to those of SIC 34. 

• SIC 36 - Electric and electronic equipment' plants are assumed to 
have work stations consisting of line controllers, interface 
units and servos together with small motors. 

Heavily Automated Industries are assumed always to receive primary power through 
service switchgear and to have central computers together with keyboard/displays 
exercising executive control over all lines. Machine stations are as follows: 

• SIC 26 - Paper and allied products plants are assumed to have work 
stations consisting of a station controller, high voltage motor 
controls and heavy duty motors. 

• SIC 28 - Chemicals and allied products factories are assumed to 
have work stations dominated by servo systems (consisting of 
station controller, interface unit, and servo circuits). 

• SIC 29 - Petroleum and Coal product plants are assumed to be 
similar to those of SIC 28. 

• SIC 30 - Rubber and plastic product plants are assumed to be 
similar to those of SIC 28. 

§ SIC 33 - Primary metal products are assumed to have work stations 
dominated by high voltage motor/control (consisting of station 
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controller, motor control, and heavy duty motors), driving 
rolling mills, etc. 

• SIC 37 - Transportation equipment factories are assumed to have 
work stations similar to SIC 28. (Highly automated milling 
machines, etc.) 

Failure Parameters 

Mean exposure-to-failure values (fiber-seconds/meter 3 ) for the equip- 
ment identified in this section are: 

• Power service switchgear , based on generic values 

for relay and control logic: E = 7 x 10 5 

• Power distribution circuits , based on generic AC power distri- 
bution values: E"=1.5 x 10 6 

• Auxiliary power , based on 220-440 V engine-generator tests: 

E = 2.2 x 10 6 

• Central computers , based on LSI-11 average over various 

tests: T = 5 x 10 5 

• Keyboard/di splays , based on TTL and CMOS oscilloscope: 

E = 4.5 x 10 5 

t Station controllers , based on PDP-8 minicomputer tests: 

E = 1 x 10 7 

• Interface units , based on use of power supply modules 4 which 

is probably the worst case: E = 1.4 x 10 7 

• Servo Units , based on generic servo motor circuits (including 
enclosure) : E = 1 x 10 8 

t High-Voltage motor control , assumed to be dominated by H.V. 
power supply: T = 1.4 x 10 7 

• Motors are assumed to have negligible vulnerability to carbon 

fibers: E = Infinity 


4 Used when H.V. is required for X-ray measurements, etc. 
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Buildings and Enclosures 


Industries are assumed to be in factory-type buildings with weather- 
stripped doors and windows. Small light industries are assumed to be located 
in medium-sized equipment buildings ventilated to provide 3 or 4 air changes 
per hour. Large industries are assumed to be located in large factory build- 
ings, with 1 or 2 air changes per hour. Central computers are assumed to 
be located in a separate equipment room inside the factory building (but with 
an exterior wall). Service switchgear is located in standard metal clad 
enclosures without forced air. High voltage controls and interface power 
supplies are assumed to be located in standard metal clad switchgear cabinets 
with forced air cooling. Enclosures for all other equipment are accounted for 
in the failure threshold values. Power and auxiliary power are assumed to be 
located in unfiltered utility rooms. 

BUSINESS SERVICES 
Typical Configurations 

System Architecture for business service facilities is very similar 
to that found in industrial process controls. Like industrial process con- 
trols, business service systems are found in a variety of sizes and config- 
urations, although they are built up from the same general types of modules. 

Typical retail or banking systems consist of a small computer, with 
or without external storage, interconnected through data interface units 
(such as multiplexers) to distributed keyboard/display stations. 

Typical data processing centers comprise one or more large computers 
with external core storage and program/control consoles together with peri- 
pheral units such as disks, tapes, line printers, and card readers. The 
central computers are often connected through input/output processors to 
remote minicomputers and keyboard/displays, to teletype lines, and sometimes 
to microwave data links. Data processing functions are sometimes distributed 
to several minicomputers, for example, using a minicomputer together with a 
keyboard/display console at data input stations. With this arrangement, 
a computer failure will affect only a portion of the data system. 


B-15 



Power for data processing systems is usually directly from the building 
distribution circuits. A battery operated inverter is often used to provide 
uninterrupted power during power outages of less than about 8 hours. Large 
central computer facilities will usually have auxiliary power; however, local 
systems in banks, brokerages, insurance offices, may not have auxiliary power. 

Failure Parameters 

Mean exposure- to- failure value thresholds are estimated to be: 

• Converters , based on discrete PC rotary inverter: F = 1 x 10 6 

• Central Computer , based on LSI-11 test data: E = 5 x 10 5 

• Keyboard/Display , based on TTL + CMOS scope: E = 4.5 x 10 s 

• Processor , based on PDP-8 tests: F = 1 x 10 7 

• I/O Interface , based on use of TTL PC boards: F = 1 x 10 7 

• Communications , based on RF trans/receiver test data: 

F = 1 x 10 7 per channel. 

Buildings and Enclosures 

All computing equipment is assumed to be housed in an equipment room 
with one exterior wall. Power and auxiliary power equipment are assumed to be 
located in air conditioned and filtered utility rooms. 

AIR TRANSPORTATION 

Air traffic control systems are of prime interest to this study and 
are used to represent the failure probability of air transportation. 

Air traffic controls are divided into: 

• Enroute controls 

• Terminal /airport controls. 

Enroute controls consist of enroute centers (ARTCC's) at Albuquerque, Anchorage, 
Atlanta, Boston, Chicago, Cleveland, Denver, Fort Worth, Great Falls, Houston, 
Indianapolis, Jacksonville, Kansas City, Los Angeles, Memphis, Miami, Minne- 
apolis, New York, Oakland, Salt Lake City, Seattle, and Washington, D.C. 
(Leesburg, Va.). Each enroute center is divided into about 15-20 sectors. 

The ARTCC has a central computer with redundant backup. Each sector has a 
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radar console/display and a data terminal. The ARTCC's are supplied with 
radar data from 97 long range (200 mile) L-band radars distributed so as 
to cover the continental U.S. (actual locations and ARTCC assignments are 
listed in the ATS Fact Book) . Radar-ARTCC data is. via C-band microwave 
links. VHF and UHF voice communications coverage is via about 450 remote 
transmitter/receiver stations (RCAGS) connected to ARTCC's by telephone voice 
lines. (Actual locations and ARTCC assignments are listed in the ATS Fact 
Book) . 

Enroute Nav-aid includes about 1000 V0R stations and 850 RF beacons 
(low and medium frequency) distributed along the airways (actual locations 
shown on aeronautical charts). There are also about 320 flight service 
stations with about 600 remote communications sites and 170 direction 
finding facilities (locations are shown in the ATS Fact Book ). There are 
about 500 airports with towers, about 200 of these having radar approach 
control facilities (including about 25 military facilities). There are 
about 580 Instrument Landing Systems (ILS). 

A typical airport approach control is divided into 4 or 5 sectors 
to cover various feeders, final approaches, and departures. Each sector 
has radar console/display and a data terminal located in separate RAPC0N 
room and connected to the terminal control (e.g., ARTS— I II) computer 
located in the tower equipment room. Sector positions are often combined 
during light traffic periods. Radar data is provided by an airport 
surveillance radar (ASR) which operates at S-band and is located at the 
airport. Air-ground communications is via VHF and UHF with transmitters 
located in remote vans on the airport and with receivers in the tower 
equipment room. 

The tower room has several communications consoles, each of which 
can handle several VHF and UHF frequencies. A high degree of redundancy is 
available in the event of a failure to a single console. Major runways 
have ILS localizer (VHF) and glideslope (UHF) located in vans near the 
associated runways. Some of the VOR facilities mentioned under enroute 
Nav-aid are located at major airports. 
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Other ATC facilities of possible interest at airports include the 
approach light controls which are currently electro-magnetic. 

Typical ATC Configurations 

Figure B.4 shows a simplified reliability diagram for terminal ATC. 

Power . The terminal building, as well as each facility, such as ILS, 
has a commercial power source, and each is backed up by an auxiliary engine- 
generator set. The airport terminal building typically will receive a distrib- 
ution voltage (e.g., 13.8 KV) from the power company through disconnect 
switches to a transformer, where it is stepped down to 120/208/408 V and distrib 
uted through a switchgear cabinet. The 480 V is distributed to various remote 
sites where an enclosed self-contained transformer/breaker/controls unit steps 
this down to voltage required at that site. Automatic transfer switches and 
automatic engine start are used to restore power during an outage at each site. 

Computers . Although no redundancy is shown in Figure B.4, there are. 
various functional redundancies and several levels of degraded modes designed 
into the computing systems. 

Communications . The air-ground transmitters and receivers and voice 
consoles in the tower and RAPCON were mentioned previously under enroute 
and terminal controls. There is also vital voice and data communications 
between the tower and RAPCON and also between the airport and its associated 
ARTCC. Voice and data communication interfaces are through coordination 
consoles, switches, and numerous terminal boards in the equipment room. 
Communications consoles, transmitters, and receivers all have dual redundancy 
with cross-strapping capability. 

Radar . Radar transmitters and receivers have dual redundancy and 
can be cross-strapped. There is at least dual redundancy with PPI displays 
with additional displays available during sector sharing operations. 

H_$_ has redundant glide-slope transmitters and redundant localizers. 

VORTAC has redundant DME transporters and VOR transmitters. 
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SW = SWITCHGEAR 

COMP = COMPUTER 

K/D = KEYBOARD/DISPLAY 

C/D = COMMUNICATIONS CONSOLE/DISPLAY 

T = TRANSMITTER 

R = RECEIVER 

GS = GLIDE SLOPE 

LOC = LOCALIZER 

PPI = PLAN POSITION INDICATOR 

DME = DISTANCE MEASURING EQUIPMENT 

VOR = VHF OMNIRANGE 

(2) = REDUNDANT UNITS 


FIGURE B.4. SIMPLIFIED RELIABILITY DIAGRAM FOR TERMINAL ATC 
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and terminal controls. There is also vital voice and data communications 
between the tower and RAPCON and also between the airport and its associated 
ARTCC. Voice and data communication interfaces are through coordination 
consoles, switches, and numerous terminal boards in the equipment room. Com- 
munications consoles, transmitters, and receivers all have dual redundancy 
with cross-strapping capability. 

Radar . Radar transmitters and receivers have dual redundancy and 
can be cross-strapped. There is at least dual redundancy with PPI displays 
with additional displays available during sector sharing operations. 

JLS. has redundant glide-slope transmitters and redundant localizers. 

VORTAC ihas redundant glide-slope transmitters and redundant localizers 
Failure Parameters 

Mean exposure- to-fai lure values are estimated to be: 


Service Switchgear (listed previously): 

E = 7 x 10 s 

Auxiliary Power (listed previously): 

E = 2.2 x 10 

Central computer (listed previously): 

E = 5 x 10 s 

Keyboard/Displays (listed previously): 

E = 4.5 x 10 

Transmitters/receivers (listed previously): 

E = 1 x 10 7 

Radar transmitter (no filter), based on 


test data: 

F = 3 x 10 6 

Radar receiver (no filter), based on 


test data 

E = 1 x 10 6 

ILS (no filter), based on ASR-3 receiver tests: 

E = 1 x 10 6 

VOR (no filter), based on ASR-3 receiver tests: 

F = 1 x 10 6 

Conmuni cations consoles, based on relay and 


control circuits: 

E = 7 x 10 s 
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Failure Parameters 


Mean exposure-to- failure values are estimated to be: 


Service Switchgear (listed previously): F = 7 x 

Auxiliary Power (listed previously): F = 2.2 

Central computer (listed previously): F = 5 x 

Keyboard/ Pi splays (listed previously): F = 4.5 

Transmitters/receivers (listed previously): F = 1 x 

Radar transmitter (no filter), based on 

test data: F = 3 x 

Radar receiver (no filter), based on 

test data F = 1 x 


• ILS (no filter), based on ASR-3 receiver tests: F = 1 x 

• VOR (no filter), based on ASR-3 receiver tests: F = 1 x 

• Communications consoles , based on relay and 

control circuits: F = 7 x 

Buildings and Enclosures 


10 s 
x 10 6 
10 s 
x 10 s 
10 7 

10 6 

10 6 

10 6 

10 6 

10 5 


The terminal power equipment is assumed to be in an unfiltered utility 
room. Computers, keyboard/displays, PPI scopes, and communications consoles 
as well as communications receivers are assumed to be located in an equipment 
room with one exterior wall. Communications transmitters, radar transmitters 
and receivers, ILS, VOR, and all site located auxiliary power are assumed to be 
located in equipment vans. 


HEALTH SERVICES 

Hospitals can be described in terms of the following functions 


or systems: 

r 

• 

Life support 

ft 

Power 

• 

Communications. 
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Typical Configurations 

Hospital configurations can be synthesized from one or more operating 
rooms, recovery rooms, and intensive care areas where life support equipment 
might be used, together with primary and auxiliary power facilities and 
emergency communi cations facilities. The following equipments are assumed 
on the basis of that found at a typical suburban or small city hospital: 

• Each operating room contains 5-10 medical devices (monitors, 
defibrillators, etc., similar in construction to GE Series 3000 
equipments) . 

• Each nurse's station has a console/display and small 
processor. 

• Power includes a coordinated secondary substation together 
with an auxiliary motor-generator set. 

• Emergency communication includes a telephone terminal and 
PBX and a radio transmitter/receiver tied into the municipal 
emergency communications network (VHF or UHF). 

Power . The coordinated secondary substation includes a 13.8 KV primary 
fused disconnect switch, 13.8 KV to 480/208/120 Volt transformer and 480/208/120 
Volt distribution switchgear panels. Auxiliary power is via a 480/208/120 Volt 
engine-generator with its own control panel. 

Li fe Support equipment typically use TTL and CMOS IC boards for pro- 
cessors together with solid state displays. Those devices vital to life sup- 
port are sealed for safe use in an oxygen-rich environment. 

Failure Parameters 

The following exposure- to-fai lure values are estimated: 

• Service switchgear (listed previously): F = 7 x 10 s 

• Auxiliary power (listed previously): F = 2.2 x 10 6 

• Processors , based on 10 TTL IC boards: F = 1 x 10 7 

• Medical monitors , based on TTL + CMOS 

scopes: F = 4.5 x 10 5 
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Buildings and Enclosures 

Service switchgear and auxiliary power units are assumed to be located 
in an unfiltered utility room. All other equipment is assumed to be located in 
double-filtered operating rooms or intensive care areas. 

TELEPHONE CENTRAL OFFICE 

Telephone central offices can be described in terms of the following 
functions: 

t Switching 

• Control 

• Communications/interface. 

Central office equipment ranges from all-relay to all-electronic using one or 
more combinations of: strowager switches in old stations, crossbar switches, 

reed relays, discreet semiconductors, minicomputers, and microprocessors. 

Crossbar systems are now the most prevalent with a trend toward 
replacement by electronic switching. Current state-of-art is represented by 
the No. 4 ESS which can handle about 550,000 long distance calls per hour and 
has a capacity of 107,000 terminations. ESS systems use ferrite core memories, 
integrated circuits for logic and switching, TDM switching, etc. Recently 
developed systems are replacing the conventional 24 V and 48 V switching with 
140 Volt D.C. (IEEE Spectrum , Feb. 1976). 

Station Configuration 

Figure B.5 shows a greatly simplified schematic diagram of a No. 5 
crossbar office. Such an office might consist of 10,000 or more line pairs 
terminating on a line frame. Crossbar switches interconnect these lines to 
junctors at the rate of 1 junctor for every 5 lines (i.e., 20% of all lines 
can be served at one time). Other crossbar switches then connect the junctors 
to trunk lines terminating on a trunk frame. Trunks include operator trunks, 
outgoing and incoming trunks to other Central Offices, and intra-office trunks 
to other subscribers in the same office. The crossbar switches also connect 
their respective lines and trunks through time-shared connectors to time-shared 
markers and time-shared registers and senders. Markers (about 7 per 10,000 
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FIGURE B.5. SIMPLIFIED SCHEMATIC OF CROSS-BAR TELEPHONE SWITCHING 


Source: Control System Engineering , Goode and Machol , McGraw-Hill Book Co., 1957. 




lines) control all selection and switching through the time-shared connectors. 
Registers and senders provide dialing, ringing, and call termination functions. 

A simplified reliability model can be defined by assuming that marker 
and register circuits are time-shared by a number of lines and that lines are 
served by a number of parallel crossbar modules (e.g., one 10 x 10 Crossbar 
module serving 100 lines). Failure effects may be approximately defined as: 

• Failure of crossbar switches might put 10 lines or 10 
trunks and/or 10 junctors out of service. 

• Failure of a marker or its associated connectors would 
cause about a 15% reduction in capacity (call s/hour). 

A marker is used about 1/2 sec. for each call. 

• Registers are used for about 12 seconds per call. If 
markers were continually busy at a rate of about 1 second 
per call it would take 12 registers/markers. Loss of one 
register would reduce capacity by about 2%. 

An even simpler assumption is that all telephone service can be de- 
fined by a large number of parallel modules, each consisting of markers + 
registers & switch modules in series. 

Failure Parameters 

Mean exposure- to-fai lure values are estimated as follows: 

• Service Switchgear (listed previously): F = 7 x 10 s 

• Auxiliary power (listed previously): E = 2.2 x 10 6 

t Marker circuits , based on discrete solid 

state circuit data: E = 1 x 10 7 

• Register circuits , based on discrete solid 

state circuit data: E = 1 x 10 7 

• Crossbar switches , based on relay and control 

circuit results: E = 7 x 10 5 
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Buildings and Enclosures 


All equipment, including power equipment, is assumed to be in an 
equipment room located within a building, and having one exterior wall (see 
category 4 type enclosure in Table 6.1). Markers and registers are assumed 
to be in a louvered equipment cabinet without forced air circulation (see 
Type 9b in Table 6.1). 

RADIO STATIONS 

Radio stations of interest include Conmercial AM and FM stations 
as well as municipal /emergency communications. 

Municipal /emergency communications include police and fire communi- 
cations in the 25-50 MHz, 148-162 MHz and 450-470 MHz bands. A typical system 
will include a central office connected to police stations, fire stations, 
and hospitals via microwave and telephone links, and to mobile units via radio. 
Remote radio transmitters are often used to obtain sufficient coverage. 

Typical Configurations 

Commercial and municipal radio communications systems typically con- 
sist of a central office (dispatcher's office, broadcast house) connected to 
remote transmitter sites via RF microwave links. 

A typical central office will include consoles and displays, a com- 
puter, a communications controller to interface the computer and consoles 
to RF and telephone conmunication links, telephone terminal equipment, and 
RF transmitter-receiver units. The system is often arranged so that the 
comnunications controller will still interconnect the console/display 
stations to the conmunication links if the computer fails. 

Remote transmitter sites typically consist of dual RF microwave 
receivers, dual modulators, dual transmitter power supplies, and dual 
transmitters together with local /remote control cabinets and consoles and 
remote monitoring via return RF microwave. Auxiliary engine generators 
provide backup power. Manual and automatic switching of redundant units 
and automatic start-up and power transfer are used to provide very high 
transmission reliability. 


R-26 



Failure Parameters 

Mean exposure- to-failure values are estimated as follows. 


Service Switchgear (listed previously): 

Auxiliary Power (listed previously): 

Console/displays (listed previously): 

Communications Controller , PDP-8: 

Central Computer , LSI-11: 

RF transmitters/receivers (listed 
previously): 

Power supply » based on data on high 
voltage power supplies: 


F = 7 x 10 5 
F = 2.2 x 10 6 
E = 4.5 x 10 s 
E = 1 x 10 7 

F = 5 x 10 5 

F = 1 x 10 7 
(per unit) 

F = 1.4 x 10 5 


Buildings and Enclosures 

The radio station visited during this project had all equipment 
located in an air conditioned and filtered building with all transmitting 
units additionally air cooled and filtered by a central air conditioning 


system. 


MUNICIPAL WATER PLANTS 

Water treatment plants include both water supply and sewage treat- 
ment plants. These plants consist of motor driven pumps and valves, motor 
controls, power supply, and supervisory controls in case of remotely 
operated stations. Modular construction is usually used and companies 
such as 6E, Westinghouse, and Square D provide modules which are applicable 
to small utility stations, pipelines, and various process controls as well 
as for water treatment plants. 


Station Configurations 

Westinghouse Catalog 55-000 shows the applications of the 
Westinghouse Electro-Centro to a typical water treatment plant. Motor 
driven pumps for 600 V, 2300 V, or 5000 V, 30 AC wound-rotor motors are used 
Each motor has an associated high voltage switchgear cabinet, high voltage 
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motor starter, high voltage manual switch, low voltage panelboard or 
switchboard, dry type distribution transformer, and station batteries. 

When connected to a primary line voltage of less than 34.5 KV, the 
distribution transformer can be connected directly to the utility supply 
through fused disconnects. Otherwise a second transformer and oil type 
breaker are usually required. 

Failure Parameters 

Mean exposure- to-fai lure values are estimated as follows: 

• Service Switchgear (listed previously): F = 7 x 10 s 

• Auxiliary Power (listed previously): F = 2.2 x 10 6 

• High voltage controls (listed previously): I s 1.4 x 10 5 

• High voltage motors: vulnerability assumed negligible. 

RAIL/RAPID TRANSIT SYSTEMS 

From the standpoint of vulnerability, the rail/transit systems can 
be described in terms of: 

t Motive Power 

• Control/communications 

• Power supply. 

Motive Power for both railways and rapid transit is provided by 
electric motors in the 600-750 volt DC range. These motors are open and 
air cooled without filters. Control panels with contactors, braking 
switches, and terminal boards are located in compartments with louvers 
without air filters. 

Control /Communications for both railroad systems and rapid transit 
systems are composed of control centers, field circuits, and communication 
links which connect the field circuits to the control centers. Control 
centers for rapid transit and for railroad centralized traffic control, 
control of interlockings, and yard controls are similar. Older office 
facilities consist of telephone type relay control panels with panel - 
mounted push buttons, switches, and indicator lights. New office facili- 
ties consist of computers plus keyboards with solid-state CRT displays and 
solid-state logic. 
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Communication links in older systems use telephone type relay line 
coding units to transmit and receive low rate PCM for controls and Indica- 
tions over line wires. In new systems these relay units have been 
replaced by higher data rate solid-state modulators and demodulators 
(communication terminals). 

Power Supply for control /communications typically consists of small 
substations to transform commercial power (e.g., 13.8 KV ) to a system distrib- 
ution voltage (e.g., 550 Volts). This distribution voltage is transformed 
to 110 V AC and rectified to required DC control voltages at each station 
and remote site. Twenty- four hour standby batteries are used at each station 
and remote site. Propulsion requires substations every 10 to 20 miles for 
railroads and every 1 to 2 miles for rapid transit. Auxiliary propulsion 
power is not provided; however, systems are often sectional 1 zed so that 
power can be fed from more than one substation. Failure of a single 
substation then results in degraded operation (e.g. , more spacing between 
trains) rather than a total system outage. 

Field ciruits for newer rapid transit systems consist of discrete 
solid-state logic and relay circuits located at stations and on-board trains 
to enforce train protection and to improve train operation. Train-to- 
station communication is typically via audio frequency track circuits. 

System Configurations for Washington METRO and for San Francisco 
BART are described briefly below. These represent the current state-of- 
art in rapid transit controls. 

Washington METRO consists of: 

• A control center with a normal and back-up Sigma-5 
Computer and solid-state keyboard/display consoles 
assigned by route-segments. Solid-state voice-band 
digital transmitter/receivers connect the central 
office to stations via cable. 

§ Stations contain discrete solid-state and relay logic 
circuits for automatic train control, voice-band trans- 
mitters/receivers for cable communications with the 
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central office, and audio frequency FSK encoders and 
decoders connected to each individual track circuit. 

• Trains contain discrete solid-state and relay logic 
circuits together with tachometer generators for auto- 
matic train control and audio frequency FSK encoders 
and decoders inductively coupled to the track. 

San Francisco BART consists of: 

• A control center with normal and back-up PR0DAC-250 
computers and solid-state consoles for programming, 
train control, electrification control, and support 
facilities control. Communication to stations is via 
45, 1200 bps digital transmission lines. The control 
center also contains an HP minicomputer system for 
sequential occupancy release of track sections to cor- 
rect problems with track circuits. 

• Stations contain discrete solid-state and relay logic 
circuits for automatic train control; an added oscil- 
lator and transposed cable system are included to pro- 
vide precise train location and speed information at 
stations. Track circuits use time division multiplexing 
of audio frequency FSK so that several track circuits 
use a single channel. 

• Trains contain discrete solid-state and relay logic to- 
gether with tachometer generators for automatic train 
control with audio frequency FSK encoders and decoders 
inductively coupled to the track. An additional receiver 
and control system are included for precision stopping 
at a station. 
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Failure Parameters 

Mean exposure- to-fai lure values are estimated as follows for the 
different equipment groups defined here: 

Control Centers 

• Central computer E = 5 x 10 s each (LSI-11) 

0 Consoles/displays E = 4.5 x 10 s each (TTL + CMOS) 

t Communications terminals E = 1 x 10 7 /line (line drivers, amplifiers) 

0 Power - switchgear 1= 7 x 10 s (relay & control logic) 

0 Power - aux. MG Set E = 2.2 x 10 6 

Stations or remote sites (about 1 per mile) 

0 Control circuits F=1 x 10 7 /station (discrete) 

0 Communications terminals F=1 x 10 7 /station (line drivers, amps) 

0 (10) track circuits F = 1 x 10 7 /station (TTL PC) 

0 Primary power F = 1.5 x 10 6 (AC power distribution) 

0 Auxiliary power F = 1 x 10 8 (battery/ terminals) 

Propulsion substation (similar to industrial power) 

0 High voltage power E = 1.6 x 10 7 per station 

0 Low voltage power F= 7 x 10 s per station 

Trains/motive power (per unit) 

0 Control system E = 1 x 10 (discrete circuits) 

0 Motor controls f = 7 x 10 s (relay & control logic) 

0 HV. propulsion motors neglected. 
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HOUSEHOLDS 


A typical household is assumed to include a color TV set; a stereo 
Hi Fi system; 4 or 5 larger appllcances such as freezers, refrigerators, 
washers, dryers, and hotplates. Small appliances consisting only of 110 V 
motors (such as sewing machines, mixers, etc.) are assumed to have 
negligible vulnerability. The vulnerability of large appliances will 
reside in the electronic controls which are prevalent in the current 
state-of-art. 

Failure Parameters 


Mean exposure- to-fai lure value thresholds are as follows: 


t 

Color TV 

E = 1.7 x 10 7 

§ 

Stereo amp 

F = 6.6 x 10 s 

• 

Large appliance 

E =1 x 10 7 each (discrete electronics) 

• 

Ranges/toasters/hotplates 

F = ? each. 

OFFICE BUILDINGS 



A typical office building has a small power substation, a telephone 
PBX, intercom equipment, and office machinery including electric type- 
writers and reproduction facilities. One or more small computers may also 
be used in the building. A typical office building has 3 or 4 elevators. 


Failure Parameters 

Mean exposure- to-fai lure values are estimated to be: 


• High voltage power 

• Low voltage switchgear 

• Telephone PBX 

• Electric typewriters 

• Reproduction facilities 

• Elevators 


E = 1.6 x 10 7 per building 
F = 7 x 10 s per building 
E = ? 

F= ? 

E = ? 

E = 7 x 10 s each (relay & central 

logic) 



Rail /Transit Systems 

From the standpoint of vulnerability, the rail /transit systems can 
be described in terms of: 

• Moti ve Power 

• Control /communications 

• Power supply. 

Motive Power for both railways and rapid transit use electric 
motors in the 600-750 volt DC range. These motors are open and air cooled 
without filters. Control panels with contactors, braking switches, and 
terminal boards are located in compartments with louver without air filters. 

Control Communications for both railroad systems and rapid transit 
systems are composed of control centers, field circuits, and communication 
links which connect the field circuits to the control centers. Control cen- 
ters for rapid transit and for railroad centralized traffic control, control 
of interlockings, and yard controls are similar. Older office facilities 
consist of telephone type relay control panels with panel-mounted push 
buttons, switches, and indicator lights. New office facilities consist of 
computers plus keyboards with solid-state CRT displays and solid-state 
logic. 

Communication links in older systems use telephone type relay line 
coding units to transmit and receive low rate PCM for controls and indica- 
tions over line wires. In new systems these relay units have been replaced 
by higher data rate solid-state modulators and demodulators (communi- 
cation terminals). 
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